joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bc10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax + 4]
sub esp, 0x34
push ebx
xor ecx, ecx
cmp eax, ecx
push esi
push edi
jne 0x42bc26
xchg edx, eax
shr bl, 0
cmp dword [ebp + 8], ecx
lea esi, [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
je 0x42bc82
cmp esi, ecx
je 0x42bc82
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp + 8]
call fcn.0042ba7e
pop ecx
lea eax, [ebp - 0x30]
push eax
lea edi, [ebp - 8]
lea ebx, [ebp - 4]
mov eax, esi
call fcn.0042bac8
cmp dword [ebp - 4], 0
pop ecx
je 0x42bc82
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
push 0x10
add eax, 0x2c
push eax
push esi
call 0x4cc8e6
add esp, 0xc
test esi, esi
je 0x42bc82
xor eax, eax
xor byte [eax + esi], 0x7a
inc eax
cmp eax, 0x10
jb 0x42bc78
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx

Function at 0x431594
Capabilities:
Encode data using xor

Disassembly:
and eax, 0xa2e93dd9
push esp
invalid
shl dword [ebp - 0x6b40420d], 1
mov ebp, 0x187b6f40
movsd dword es:[edi], dword [esi]
mov ebp, 0x40bd94bf
outsd dx, dword [esi]
jnp 0x431571
pop ecx
scasd eax, dword es:[edi]
clc
adc byte [eax], bl
sbb eax, 0xfd5c960e
aaa
push ebp
xor eax, 0xb3f377de
xor dword [ebp - 0x30], ecx
mov ecx, 0x70e5af96
fsub qword [edi - 0x95e9855]
pushal
jo 0x43154f
cmpsd dword [esi], dword es:[edi]
stosd dword es:[edi], eax
mov eax, dword [0x60f6]
mov bl, 0xe5
mov al, 0xa5
dec ebp
cmc
popfd
invalid
adc eax, 0x35e522a1
aad 0x37
or byte [eax + 0x9b97c48], 0x19
dec eax
jl 0x431550
or dword [ecx], ebx
dec eax
jl 0x431550
or dword [ecx], ebx
pop edi
jp 0x431529
in eax, 0x7b
cmp dword [ebp - 0x29], esi
jl 0x4315d7
push edi
jp 0x43154e
out dx, eax
arpl di, ax
dec esp
les ebp, [ecx + 0xb6ec72b]
pop esi
cwde
std
mov edx, 0x9ff68272
inc edx
jns 0x43158b
mov byte [0xd6bd1e99], al
adc ebx, dword [ecx + 0x6c]
pop ss
add dword [0xb1f81a3f], edi
enter 0xfffffffffffff12e, 0xffffffffffffffb7
int 0x98
sahf
inc edi
les edi, [edx]
dec edi
adc bl, al
jnp 0x431579
add ebp, 0x6b8d5b71
cmp byte [eax - 0xdc812a3], cl
add al, 0x95
push ecx
adc eax, 0x67a9da4c
jo 0x431640
mov dh, 0xbf
or byte [esi + 0x7bf5282f], bl
hlt
cmpsd dword [esi], dword es:[edi]
mov esp, 0xa1b636c3
rol dh, 1
jmp 0x8b2f867e
sub byte gs:[edi + 0x1f], ch
jge 0x431606
push 0x77
ficomp dword [esi]
sub dword [esi - 0x4cc64867], ecx
cwde
outsb dx, byte [esi]
xor al, 0x71
adc byte [edi], cl
push esp
jmp 0x43160c
andps xmm5, xmm3
enter 0x79cf, 0xfffffffffffffffd
pop eax
jp 0x431670
pushfd
enter 0x4bba, 0x4e
jne 0x43162b
mov dword [ebp - 0x59952224], esi
int1
jmp [eax + 0x5f]
jg 0x43169c
jno 0x43167c
daa
cmp cl, byte [ebp - 0x40ca50e3]
sub al, 0x3a
and eax, 0xd851d9d4
cmp ah, byte [0xd851d9d4]
mov al, cl
invalid
push ecx
mov dh, 0x2c
cwde
invalid
Function at 0x438fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x438fd5
xor eax, eax
jmp 0x439089
push 0x28
push esi
push edi
call 0x4e5492
add ah, al
or al, 0xff
jne 0x438fec
lea ecx, [ebp - 0x1c]
call dword [0x4b74e4]
push esi
lea ecx, [ebp - 0x1c]
call dword [0x4b7518]
add byte [esi - 0x73], dl
dec ebp
in al, 0xff
adc eax, 0x4b7518
cmp eax, esi
je 0x439016
cmp byte [eax], 0
mov ecx, eax
je 0x439016
mov al, byte [ecx]
cmp al, 0x41
jl 0x439010
cmp al, 0x5a
jg 0x439010
add al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x439002
push ebx
push dword [ebp - 8]
lea ecx, [ebp - 0x1c]
push esi
call dword [0x4b7518]
call fcn.00438db7
pop ecx
mov ecx, dword [ebp - 8]
push 0x25
movzx ebx, ax
pop eax
cmp ecx, eax
mov dword [ebp + 8], ecx
jbe 0x43903d
mov dword [ebp + 0x28], eax
push dword [ebp]
lea ecx, [ebp - 0x1c]
push 0
lea esi, [edi + 3]
call dword [0x4b7518]
push eax
push esi
call 0x4d9ef4
mov ecx, dword [ebp + 8]
mov al, cl
add esp, 0xc
add al, 2
test esi, esi
mov word [edi + 1], bx
mov byte [edi], al
pop ebx
je 0x43907d
test ecx, ecx
je 0x43907d
xor eax, eax
test ecx, ecx
jbe 0x43907d
xor byte [eax + esi], 0x5a
inc eax
cmp eax, ecx
jb 0x439074
lea ecx, [ebp - 0x1c]
call dword [0x4b74e0]
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x43921e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax + 4]
sub esp, 0x34
push ebx
xor ecx, ecx
cmp eax, ecx
push esi
push edi
jne 0x439234
xchg edx, eax
shr bl, 0
cmp dword [ebp + 8], ecx
lea esi, [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
je 0x439290
cmp esi, ecx
je 0x439290
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp + 8]
call fcn.0043908c
pop ecx
lea eax, [ebp - 0x30]
push eax
lea edi, [ebp - 8]
lea ebx, [ebp - 4]
mov eax, esi
call fcn.004390d6
cmp dword [ebp - 4], 0
pop ecx
je 0x439290
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
push 0x10
add eax, 0x2c
push eax
push esi
call 0x4d9ef4
add esp, 0xc
test esi, esi
je 0x439290
xor eax, eax
xor byte [eax + esi], 0x7a
inc eax
cmp eax, 0x10
jb 0x439286
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
Function at 0x4413ae
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x3a18d66b]
test eax, 0x622e4950
mov byte [ecx], 0x9f
jo 0x441425
wait
pop esp
and edi, dword [edx]
pop eax
je 0x44143e
movsb byte es:[edi], byte [esi]
nop
movsd dword es:[edi], dword [esi]
mov dword [0x226cf495], eax
pop ss
stosb byte es:[edi], al
popal
wait
sub dword [ecx - 0x76], ecx
xor dword cs:[esi + 0x764338b0], eax
cmp byte [ebx + 0x76], al
jb 0x44142a
stosd dword es:[edi], eax
xor byte [edx + 4], cl
jnp 0x4413d7
dec ebx
pushal
invalid
sub al, 0x73
inc ebx
enter 0x3018, 0xffffffffffffffee
push cs
retf
sbb eax, 0xd49b4db0
mov word [esp - 0x18], ss
xor al, 0xcf
xor ah, byte [ecx - 0x7a]
mov al, byte [ebp + 0x33]
jo 0x4413c4
test dword [edx], esp
in al, 0xdb
invalid
daa
mov edi, ebp
add ebx, dword [edx - 0x5be22d83]
rcr dword [ebx + 0x54a6ddab], cl
sal dword [edi], 1
ficom word [edx]
add al, 0xd4
push edi
dec eax
or byte [edx], cl
jl 0x44149e
insb byte es:[edi], dx
aad 0x3b
jmp 0x4413ed
sbb al, 0x7c
wait
out 0xc9, eax
les edi, [edi - 0xa]
pop eax
xor eax, 0x79cad764
mov ss, word [esp + 0x1e5a5677]
loop 0x441499
iretd

Function at 0x445dcb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x445de0
xor eax, eax
jmp 0x445e94
push 0x28
push esi
push edi
call 0x4f229d
add ah, al
or al, 0xff
jne 0x445df7
lea ecx, [ebp - 0x1c]
call dword [0x4b74e4]
push esi
lea ecx, [ebp - 0x1c]
call dword [0x4b7518]
add byte [esi - 0x73], dl
dec ebp
in al, 0xff
adc eax, 0x4b7518
cmp eax, esi
je 0x445e21
cmp byte [eax], 0
mov ecx, eax
je 0x445e21
mov al, byte [ecx]
cmp al, 0x41
jl 0x445e1b
cmp al, 0x5a
jg 0x445e1b
add al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x445e0d
push ebx
push dword [ebp - 8]
lea ecx, [ebp - 0x1c]
push esi
call dword [0x4b7518]
call fcn.00445bc2
pop ecx
mov ecx, dword [ebp - 8]
push 0x25
movzx ebx, ax
pop eax
cmp ecx, eax
mov dword [ebp + 8], ecx
jbe 0x445e48
mov dword [ebp + 0x28], eax
push dword [ebp]
lea ecx, [ebp - 0x1c]
push 0
lea esi, [edi + 3]
call dword [0x4b7518]
push eax
push esi
call 0x4e6cff
mov ecx, dword [ebp + 8]
mov al, cl
add esp, 0xc
add al, 2
test esi, esi
mov word [edi + 1], bx
mov byte [edi], al
pop ebx
je 0x445e88
test ecx, ecx
je 0x445e88
xor eax, eax
test ecx, ecx
jbe 0x445e88
xor byte [eax + esi], 0x5a
inc eax
cmp eax, ecx
jb 0x445e7f
lea ecx, [ebp - 0x1c]
call dword [0x4b74e0]
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x44602d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax + 4]
inc eax
add al, 0x83
in al, dx
xor al, 0x53
xor ecx, ecx
cmp eax, ecx
push esi
push edi
jne 0x44603f
xchg edx, eax
shr bl, 0
cmp dword [ebp + 8], ecx
lea esi, [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
je 0x44609b
cmp esi, ecx
je 0x44609b
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp + 8]
call fcn.00445e97
pop ecx
lea eax, [ebp - 0x30]
push eax
lea edi, [ebp - 8]
lea ebx, [ebp - 4]
mov eax, esi
call fcn.00445ee1
cmp dword [ebp - 4], 0
pop ecx
je 0x44609b
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
push 0x10
add eax, 0x2c
push eax
push esi
call 0x4e6cff
add esp, 0xc
test esi, esi
je 0x44609b
xor eax, eax
xor byte [eax + esi], 0x7a
inc eax
cmp eax, 0x10
jb 0x446091
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx

Function at 0x453035
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x45304a
xor eax, eax
jmp 0x4530fe
push 0x28
push esi
push edi
call 0x4ff507
add ah, al
or al, 0xff
jne 0x453061
lea ecx, [ebp - 0x1c]
call dword [0x4b74e4]
push esi
lea ecx, [ebp - 0x1c]
call dword [0x4b7518]
add byte [esi - 0x73], dl
dec ebp
in al, 0xff
adc eax, 0x4b7518
cmp eax, esi
je 0x45308b
cmp byte [eax], 0
mov ecx, eax
je 0x45308b
mov al, byte [ecx]
cmp al, 0x41
jl 0x453085
cmp al, 0x5a
jg 0x453085
add al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x453077
push ebx
push dword [ebp - 8]
lea ecx, [ebp - 0x1c]
push esi
call dword [0x4b7518]
call fcn.00452e2c
pop ecx
mov ecx, dword [ebp - 8]
push 0x25
movzx ebx, ax
pop eax
cmp ecx, eax
mov dword [ebp + 8], ecx
jbe 0x4530b2
mov dword [ebp + 0x28], eax
push dword [ebp]
lea ecx, [ebp - 0x1c]
push 0
lea esi, [edi + 3]
call dword [0x4b7518]
push eax
push esi
call 0x4f3f69
mov ecx, dword [ebp + 8]
mov al, cl
add esp, 0xc
add al, 2
test esi, esi
mov word [edi + 1], bx
mov byte [edi], al
pop ebx
je 0x4530f2
test ecx, ecx
je 0x4530f2
xor eax, eax
test ecx, ecx
jbe 0x4530f2
xor byte [eax + esi], 0x5a
inc eax
cmp eax, ecx
jb 0x4530e9
lea ecx, [ebp - 0x1c]
call dword [0x4b74e0]
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x453293
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax + 4]
sub esp, 0x34
push ebx
xor ecx, ecx
cmp eax, ecx
push esi
push edi
jne 0x4532a9
xchg edx, eax
shr bl, 0
cmp dword [ebp + 8], ecx
lea esi, [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
je 0x453305
cmp esi, ecx
je 0x453305
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp + 8]
call fcn.00453101
pop ecx
lea eax, [ebp - 0x30]
push eax
lea edi, [ebp - 8]
lea ebx, [ebp - 4]
mov eax, esi
call fcn.0045314b
cmp dword [ebp - 4], 0
pop ecx
je 0x453305
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
push 0x10
add eax, 0x2c
push eax
push esi
call 0x4f3f69
add esp, 0xc
test esi, esi
je 0x453305
xor eax, eax
xor byte [eax + esi], 0x7a
inc eax
cmp eax, 0x10
jb 0x4532fb
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
Function at 0x45ac86
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
in al, dx
add byte [ebp + 0x4b], bl
sar byte [ebp - 0x68d9188e], 0x5f
xchg cl, bh
stosb byte es:[edi], al
jae 0x45ace0
out 0xc7, eax
scasd eax, dword es:[edi]
adc al, 0xac
int1
cwde
add byte [ecx], bl
aad 0xa0
xor al, 0x13
scasd eax, dword es:[edi]
sahf
jmp 0x45ac81
test al, 0xde
arpl bx, sp
stosb byte es:[edi], al
pop ebp
push esi
invalid

Function at 0x45fe3e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x45fe53
xor eax, eax
jmp 0x45ff07
push 0x28
push esi
push edi
call 0x50c310
add ah, al
or al, 0xff
jne 0x45fe6a
lea ecx, [ebp - 0x1c]
call dword [0x4b74e4]
push esi
lea ecx, [ebp - 0x1c]
call dword [0x4b7518]
add byte [esi - 0x73], dl
dec ebp
in al, 0xff
adc eax, 0x4b7518
cmp eax, esi
je 0x45fe94
cmp byte [eax], 0
mov ecx, eax
je 0x45fe94
mov al, byte [ecx]
cmp al, 0x41
jl 0x45fe8e
cmp al, 0x5a
jg 0x45fe8e
add al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x45fe80
push ebx
push dword [ebp - 8]
lea ecx, [ebp - 0x1c]
push esi
call dword [0x4b7518]
call fcn.0045fc35
pop ecx
mov ecx, dword [ebp - 8]
push 0x25
movzx ebx, ax
pop eax
cmp ecx, eax
mov dword [ebp + 8], ecx
jbe 0x45febb
mov dword [ebp + 0x28], eax
push dword [ebp]
lea ecx, [ebp - 0x1c]
push 0
lea esi, [edi + 3]
call dword [0x4b7518]
push eax
push esi
call 0x500d72
mov ecx, dword [ebp + 8]
mov al, cl
add esp, 0xc
add al, 2
test esi, esi
mov word [edi + 1], bx
mov byte [edi], al
pop ebx
je 0x45fefb
test ecx, ecx
je 0x45fefb
xor eax, eax
test ecx, ecx
jbe 0x45fefb
xor byte [eax + esi], 0x5a
inc eax
cmp eax, ecx
jb 0x45fef2
lea ecx, [ebp - 0x1c]
call dword [0x4b74e0]
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x46009c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax + 4]
sub esp, 0x34
push ebx
xor ecx, ecx
cmp eax, ecx
push esi
push edi
jne 0x4600b2
xchg edx, eax
shr bl, 0
cmp dword [ebp + 8], ecx
lea esi, [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
je 0x46010e
cmp esi, ecx
je 0x46010e
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp + 8]
call fcn.0045ff0a
pop ecx
lea eax, [ebp - 0x30]
push eax
lea edi, [ebp - 8]
lea ebx, [ebp - 4]
mov eax, esi
call fcn.0045ff54
cmp dword [ebp - 4], 0
pop ecx
je 0x46010e
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
push 0x10
add eax, 0x2c
push eax
push esi
call 0x500d72
add esp, 0xc
test esi, esi
je 0x46010e
xor eax, eax
xor byte [eax + esi], 0x7a
inc eax
cmp eax, 0x10
jb 0x460104
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
Function at 0x464f6c
Capabilities:
Encode data using xor

Disassembly:
dec dword [edx - 0x5fe1e627]
xor dword [ecx], edi
sub byte [edi], bh
nop
sbb al, 0x6e
mov ecx, 0xe186318e
inc ebx
std
push esi
sal byte [esi + 0x192504f5], 0x5a
imul edx, dword [edx + edi*8], 0x19
test bh, 0xc
add ch, byte [ebp - 0x60]
aas
sbb dword [esi + 0x7681d993], ebp
push eax
cld
jns 0x464f49
ja 0x464fb4
push cs
cdq
aas
xor bh, byte [ebx + 0x57]
retf 0x5899
sub dword [esi - 0x3c], 0xe226993b
into
dec ebp
mov ecx, 0xec9cdc66
sti
adc dword [ecx - 0x4e047b43], ecx
dec esi
mov al, byte [0x2ba449fc]
sub dh, dh
sahf
mov eax, dword [0xbe768b1f]
call [ebp + 0x4e]
and bl, byte [esi]
add dword [ebx], edi
add ebx, ecx
mov cl, 0x8f
add byte [esi - 0x48fd27e0], bl
int1
dec esi
xchg esp, eax
dec ecx
or edi, edi
and dword [eax + 0x23], edi
pop esi
popal
int3
Function at 0x4016e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
push 0x214c6981
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x20], eax
push 0x104
lea eax, [ebp - 0x2c0]
push eax
call dword [ebp - 0x20]
push 0x1c368da0
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x14], eax
call dword [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x15c]
push ecx
call section..text
add esp, 0xc
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x144], 0x2e
mov byte [ebp - 0x143], 0x64
mov byte [ebp - 0x142], 0x6c
mov byte [ebp - 0x141], 0x6c
mov byte [ebp - 0x140], 0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x2c0]
push eax
call fcn.00401270
add esp, 8
lea ecx, [ebp - 0x15c]
push ecx
lea edx, [ebp - 0x2c0]
push edx
call fcn.00401270
add esp, 8
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x2c0]
push ecx
call fcn.00401270
add esp, 8
push 0x4e1e0843
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x1ac], eax
push 0x7463a627
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x148], eax
push 0x70ebfb28
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x289fbd13
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x10], eax
push 0
push 0x80
push 2
push 0
push 0
push 0x10000000
lea edx, [ebp - 0x2c0]
push edx
call dword [ebp - 0x1ac]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffff
je 0x40183f
mov dword [ebp - 0x2c4], 0
push 0
lea eax, [ebp - 0x2c4]
push eax
push 0x5c00
push 0x41f050
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [ebp - 0x148]
mov edx, dword [ebp - 0x13c]
push edx
call dword [ebp - 0x1c]
mov byte [ebp - 0x1b8], 0x52
mov byte [ebp - 0x1b7], 0x75
mov byte [ebp - 0x1b6], 0x6e
mov byte [ebp - 0x1b5], 0x64
mov byte [ebp - 0x1b4], 0x6c
mov byte [ebp - 0x1b3], 0x6c
mov byte [ebp - 0x1b2], 0x33
mov byte [ebp - 0x1b1], 0x32
mov byte [ebp - 0x1b0], 0x20
mov byte [ebp - 0x1af], 0
mov byte [ebp - 0xc], 0x20
mov byte [ebp - 0xb], 0x45
mov byte [ebp - 0xa], 0x78
mov byte [ebp - 9], 0x62
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x75
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0
push 0x44
push 0
lea eax, [ebp - 0x1a8]
push eax
call fcn.00401250
add esp, 0xc
mov dword [ebp - 0x1a8], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.00401250
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x2c0]
push eax
call fcn.00401270
add esp, 8
lea ecx, [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0x128]
push edx
call fcn.00401e90
add esp, 8
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x128]
push ecx
call fcn.00401270
add esp, 8
push 0
lea edx, [ebp - 0x128]
push edx
call dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x401c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
call fcn.004012f0
push 0x4ee61051
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x23c], eax
push 0x384977d3
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.00401100
add esp, 8
mov dword [ebp - 0x238], eax
push 0x7f8a
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
push eax
call dword [ebp - 0x238]
call fcn.004012e0
call fcn.00401930
call fcn.004016e0
push 0x660c1c02
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x240], eax
push 0x104
lea edx, [ebp - 0x220]
push edx
push 0
call dword [ebp - 0x240]
push 0x214c6981
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x224], eax
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [ebp - 0x224]
mov byte [ebp - 0x234], 0x5c
mov byte [ebp - 0x233], 0x5c
mov byte [ebp - 0x232], 0x73
mov byte [ebp - 0x231], 0x79
mov byte [ebp - 0x230], 0x73
mov byte [ebp - 0x22f], 0x74
mov byte [ebp - 0x22e], 0x65
mov byte [ebp - 0x22d], 0x6d
mov byte [ebp - 0x22c], 0x2e
mov byte [ebp - 0x22b], 0x65
mov byte [ebp - 0x22a], 0x78
mov byte [ebp - 0x229], 0x65
mov byte [ebp - 0x228], 0
lea ecx, [ebp - 0x234]
push ecx
lea edx, [ebp - 0x118]
push edx
call fcn.00401270
add esp, 8
push 1
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x220]
push ecx
call dword [ebp - 0x10]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4040f3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402fe1
and dword [ebp - 4], 0
cmp dword [0x425260], 0
mov ebx, eax
jne 0x4041a4
push 0x409870
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404255
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x409864
push edi
call esi
test eax, eax
je 0x404255
push eax
call fcn.00402f6f
mov dword [esp], 0x409854
push edi
mov dword [0x425260], eax
call esi
push eax
call fcn.00402f6f
mov dword [esp], 0x409840
push edi
mov dword [0x425264], eax
call esi
push eax
call fcn.00402f6f
mov dword [esp], 0x409824
push edi
mov dword [0x425268], eax
call esi
push eax
call fcn.00402f6f
pop ecx
mov dword [0x425270], eax
test eax, eax
je 0x4041a4
push 0x40980c
push edi
call esi
push eax
call fcn.00402f6f
pop ecx
mov dword [0x42526c], eax
mov eax, dword [0x42526c]
cmp eax, ebx
je 0x4041fc
cmp dword [0x425270], ebx
je 0x4041fc
push eax
call fcn.00402fea
push dword [0x425270]
mov esi, eax
call fcn.00402fea
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4041fc
test edi, edi
je 0x4041fc
call esi
test eax, eax
je 0x4041f3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4041f3
test byte [ebp - 0xc], 1
jne 0x4041fc
or dword [ebp + 0x10], 0x200000
jmp 0x404235
mov eax, dword [0x425264]
cmp eax, ebx
je 0x404235
push eax
call fcn.00402fea
pop ecx
test eax, eax
je 0x404235
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404235
mov eax, dword [0x425268]
cmp eax, ebx
je 0x404235
push eax
call fcn.00402fea
pop ecx
test eax, eax
je 0x404235
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x425260]
call fcn.00402fea
pop ecx
test eax, eax
je 0x404255
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404257
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405ece
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b9f8]
jne 0x405ed8
repz ret
jmp fcn.004075f5
Function at 0x48af29
Capabilities:
Encode data using xor

Disassembly:
add bh, byte [0x942fa493]
mov esp, 0xdbd6ed1b
mov eax, dword [0x4fb6f0f7]
daa
daa
pop edi
fidiv dword [eax + 0x74b75891]
arpl si, dx
dec esp
invalid
dec ebp
js 0x48aee6
lcall 0xaa15, 0x79fb9eb3
stosb byte es:[edi], al
xor byte [eax - 0x72ebd97b], ch
psadbw mm0, qword [ebx]
xor bh, dl
jns 0x48afa4
pop ebx
mov edi, dword [ebx + ebx*8]
rep insd dword es:[edi], dx
ficom word [ecx + 0x5571561c]
invalid
sbb byte [ebx - 0x47], dl
jle 0x48af9d
ljmp 0xc4ad:0x1ccfca3b
push edi
popfd
fstp qword [esi + 0x752c37b2]
dec ebx
jne 0x48aff1
push edx
invalid
mov ch, 0x44
xor edx, edx
jnp 0x48af7b
add byte [ecx - 0x5f], dl
dec edi
adc dword [ebx + 0x19], 0x74c08536
das
inc edi
and eax, 0x3b3ef485
mov esp, eax
out 0xa7, al
or bh, dl
sbb al, 0xe1
push esp
cmc
loope 0x48b08d
pop ds
or dword [ecx - 0x34527e0c], ebp
in eax, 0x3c
add al, byte [edx + 0x3e]
js 0x48b012
out 0xa2, eax
jo 0x48b05a
stosb byte es:[edi], al
dec esi
test byte [edx + 0x6d], bl
sub byte [eax + 1], ch
arpl di, bx
jg 0x48b0a7
inc ecx
rol byte [eax + ebp*4 - 0x4dc69160], 1
out 0xcf, al
push edx
lodsb al, byte [esi]
mov eax, 0xc05f02fc
dec edx
jnp 0x48b077
out dx, eax
xchg esi, eax
sbb eax, 0xbf3ceae7
out 0xea, eax
cmp al, 0xbf
lock add bl, byte [ebp + 0xa]
cdq
ret 0x75c9
sbb al, 0x19
scasb al, byte es:[edi]
test al, 5
sbb dword [edx + 0x39], 0x13b7651d
out 0x3d, al
stosd dword es:[edi], eax
xchg ecx, eax
push 0xe34ba53a
pop ss
inc ebx
clc
and eax, 0xd4f8eec8
aas
pop ds
stosb byte es:[edi], al
sbb byte [eax + 0x49], 0xc8
mov al, byte [0x22b5b6f9]
mov es, ebp
xchg dword [ebx + 0x42fad92], ebp
adc ebp, esp
nop
xchg ecx, eax
test dword [ecx + 7], edi
mov byte [ebx], dl
sahf
or dword [ebp - 0x65d74044], eax
rol byte [edx - 0x5c], cl
bound edx, qword [0x62400284]
invalid
add al, byte [edi]
jp 0x48b04b
arpl di, si
adc dword [ebx], 0x37
fisubr word [edx + 0x61]
or al, 0x4f
aaa
dec edx
and byte [ecx], bh
and ebp, dword [ebx + eax*8 - 0x56]
lahf
adc byte [eax], dl
out 0xd8, al
sub al, 0x12
sub dword [ebp - 0x4cf2cdf2], ebp
cdq
and dl, bh
mov esp, edi
jo 0x48b05a
sbb bh, byte [ebp + 0x15d2b2ca]
dec edi
and ch, ch
les edx, [esi]
inc edx
imul ebx, dword [eax + esi*8], 0x34
inc edi
hlt
Function at 0x4ba915
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3398
cmp edx, dword [eax]
je 0x4ba937
add eax, 8
inc ecx
cmp eax, 0x4c3428
jl 0x4ba928
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3398]
jne 0x4baa65
mov eax, dword [0x4c7d1c]
cmp eax, 1
je 0x4baa3f
test eax, eax
jne 0x4ba968
cmp dword [0x4c32c0], 1
je 0x4baa3f
cmp edx, 0xfc
je 0x4baa65
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba99f
lea eax, [ebp - 0x1a4]
push 0x4bfb78
push eax
call fcn.004bb300
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb790
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba9e2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb790
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfb74
push edi
call fcn.004bd660
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfb58
push eax
call fcn.004bb300
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb310
lea eax, [ebp - 0xa0]
push 0x4bfb54
push eax
call fcn.004bb310
push dword [esi + 0x4c339c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb310
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfb2c
push eax
call fcn.004bd5d4
add esp, 0x2c
pop edi
jmp 0x4baa65
lea eax, [ebp + 8]
lea esi, [esi + 0x4c339c]
push 0
push eax
push dword [esi]
call fcn.004bb790
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret