joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401830
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x50
push ebx
mov eax, dword [esp + 0x58]
push ebp
push esi
push edi
mov ebx, dword [eax + 8]
mov ecx, 0x10
mov esi, 0x41b040
lea edi, [esp + 0x1c]
mov dword [esp + 0x64], ebx
rep movsd dword es:[edi], dword [esi]
fild dword [esp + 0x64]
fmul qword [str.UUUUUU]
mov ebp, dword [eax + 4]
movsb byte es:[edi], byte [esi]
xor edi, edi
call sub.MSVCRT.dll__ftol
mov ecx, 1
sub ecx, eax
mov eax, 0x38e38e39
mul ecx
shr edx, 4
lea eax, [ecx + edx*2 + 2]
mov ecx, dword [esp + 0x68]
push eax
call sub.MFC42.DLL_CString::GetBuffer
xor ecx, ecx
mov esi, eax
test ebx, ebx
jle 0x401969
mov al, byte [edi + ebp]
mov byte [esp + 0x14], al
mov edx, dword [esp + 0x14]
and edx, 0xff
mov ebx, edx
shr ebx, 2
inc ecx
inc edi
mov bl, byte [esp + ebx + 0x1c]
mov byte [esi + ecx - 1], bl
mov ebx, dword [esp + 0x64]
cmp edi, ebx
jge 0x401945
mov al, byte [edi + ebp]
and edx, 3
mov byte [esp + 0x10], al
mov eax, dword [esp + 0x10]
and eax, 0xff
mov ebx, eax
shr ebx, 4
shl edx, 4
or ebx, edx
inc ecx
inc edi
mov dl, byte [esp + ebx + 0x1c]
mov byte [esi + ecx - 1], dl
mov edx, dword [esp + 0x64]
cmp edi, edx
jge 0x40195a
mov dl, byte [edi + ebp]
and eax, 0xf
mov byte [esp + 0x18], dl
inc edi
mov edx, dword [esp + 0x18]
and edx, 0xff
mov ebx, edx
and edx, 0x3f
shr ebx, 6
shl eax, 2
mov dl, byte [esp + edx + 0x1c]
or ebx, eax
inc ecx
mov al, byte [esp + ebx + 0x1c]
mov ebx, 0x48
mov byte [esi + ecx - 1], al
mov byte [esi + ecx], dl
inc ecx
xor edx, edx
mov eax, ecx
div ebx
test edx, edx
jne 0x401939
mov byte [esi + ecx], 0xd
inc ecx
mov byte [esi + ecx], 0xa
inc ecx
cmp edi, dword [esp + 0x64]
jl 0x401892
jmp 0x401969
and eax, 3
shl eax, 4
inc ecx
mov al, byte [esp + eax + 0x1c]
mov byte [esi + ecx - 1], al
mov byte [esi + ecx], 0x3d
jmp 0x401968
mov al, byte [esp + 0x10]
and eax, 0xf
mov dl, byte [esp + eax*4 + 0x1c]
mov byte [esi + ecx], dl
inc ecx
mov byte [esi + ecx], 0x3d
mov byte [esi + ecx + 1], 0
mov ecx, dword [esp + 0x68]
push 0xffffffffffffffff
call sub.MFC42.DLL_CString::ReleaseBuffer
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x50
ret 8
Function at 0x40ae28
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret

Function at 0x4121dc
Capabilities:
Encode data using xor

Disassembly:
das
mov esi, 0xed5e44fe
inc ecx
cdq
fidiv dword [edi + ecx*8]
xor dword [ebx + 0x50], 0x44
inc esp
inc esi
std
mov esp, cr6
mov ebp, 0x536db0ba
pop ecx
cmpsd dword [esi], dword es:[edi]
imul edx, ebp, 0xa2d33b38
pop ebp
pop edx
xor al, 6
mov byte [0x345a5df2], al
push es
xor byte [ebp + 0x1c], 0xe7
out dx, eax
cdq
adc dword [ecx], edx
sbb al, al
shr ebp, cl
cli
aam 0xc2
sub al, 6
add dword [eax + 0x21a2cce8], ebx
dec edx
adc esp, dword fs:[0x69f0f0b7]
sub ebp, dword [edx]
mov ecx, 0xf2628f75
or al, 0x83
jle 0x4121fd
test dword [ebp + 1], eax
invalid
Function at 0x103ba004
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103ba00e
pushal
call 0x103ba014
pop ebp
sub ebp, 0x10
sub ebp, 0x3ba004
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103ba038
and al, 0x28
add byte [eax], al
add byte [eax - 0x7bf0fe08], al
pop es
add byte [eax], al
add byte [ecx + 0x33], ah
rol byte [eax - 0x3e], 0xc
add cl, ch
add al, 0
add byte [eax], al
pop esp
push ebx
xor ch, byte [eax + 0x3ba004b8]
add byte [ebx], al
lds eax, [ecx + 0x63c0]
add byte [ecx + 0x5ef], bh
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103ba041
mov eax, 0x3ba004
add eax, ebp
add eax, 0x63
mov ecx, 0x5ef
mov edx, 0x39aa301a
xor byte [eax], dl
inc eax
dec ecx
jne 0x103ba058
jmp 0x103ba06b
xchg ecx, eax
xlatb
xchg ecx, eax
xchg ebx, eax
sbb bl, byte es:[edx]
sbb bl, byte [edx]
sbb bl, byte [ebx + 0x1a1ae2db]
sbb bl, byte [ecx]
xlatb
mov byte [0x1a1a1a1c], al
mov al, byte [0x1a1a1a32]
in eax, dx
clc
sbb edx, edx
xchg ecx, eax
wait
push ss
sbb bl, byte [edx]
sbb bl, byte [ecx]
fist word [edi - 0x6c19c182]
push ds
dec edx
jb 0x103ba10d
adc al, 0x1a
jb 0x103ba023
cmp esi, dword [edi]
sbb bl, byte [ebx]
jb 0x103ba038
inc edx
adc edi, dword [esi]
pop ds
sbb bl, byte [edx]
sbb dh, bl
xor byte [edx], bl
sbb bl, byte [edx]
dec edi
xchg edi, eax
jbe 0x103ba0f7
sbb dl, byte [ecx + 0x1a1a129f]
sbb dl, byte [ecx + 0x1a1a168f]
sbb dl, byte [ecx + 0x1a1a0a97]
sbb bl, bl
sbb byte [ebx], ch
sbb byte [ecx + 0x15531ed8], bl
lahf
out dx, al
in eax, 0xe5
in eax, 0x47
fcom dword [esi]
sbb dl, byte [ecx + 0x1a1e3e96]
sbb bl, byte [edx]
jb 0x103ba15a
adc al, 0x1a
jb 0x103ba070
cmp esi, dword [edi]
sbb bl, byte [ebx]
dec ebx
pop ds
sbb bl, byte [edx]
sbb dh, bl
pop edi
sbb bl, byte [edx]
pop edi
sbb byte [edx], bl
sbb cl, byte [edi + 0x4e]
dec esi
inc edi
in eax, 0x6f
push ss
in eax, 0x6f
adc dh, dl
bound ebx, qword [edx]
sbb bl, byte [edx]
xchg ecx, eax
cmpsd dword [esi], dword es:[edi]
adc bl, byte [edx]
sbb bl, byte [edx]
wait
jmp 0x103ba0ff
push esi
and ebx, dword [ebx]
cdq
fistp dword [edi]
cdq
push ds
repe cmpsd dword [esi], dword es:[edi]
in eax, 0xe5
in eax, 0x33
dec esi
and ebx, dword [eax]
cdq
fistp dword [ecx + ebx*4]
invalid
Function at 0x1010d770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1010d77f
pop dword [ebp - 0x10]
mov eax, 0x1010d77f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x376e969c
sub dword [ebp - 0x20], 0xe91c5151
mov dword [ebp - 0x1c], 0x5765f2f7
add dword [ebp - 0x1c], 0xdacd594e
mov dword [ebp - 0x18], 0x32af8ab3
sub dword [ebp - 0x18], 0xe6634685
mov dword [ebp - 0x14], 0x5f49673d
add dword [ebp - 0x14], 0xa0b698c3
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x15d7a2e0
add dword [ebp - 0x20], 0x5e9ac676
mov dword [ebp - 0x1c], 0x9e89af79
add dword [ebp - 0x1c], 0xa2e2b1fc
mov dword [ebp - 0x18], 0xc3c7555a
add dword [ebp - 0x18], 0x9fa81712
mov dword [ebp - 0x14], 0x9befed5a
sub dword [ebp - 0x14], 0x9befed5a
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xaab1948f
sub eax, 0x9a8a146b
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x60594
push 0
call eax
mov ecx, 0x7ce6e691
sub ecx, 0x7ce6aa3f
xor ebx, ebx
add ebx, eax
mov esi, 0x44917fcb
sub esi, 0x346085cb
add esi, dword [ebp - 0x10]
mov edx, 0x92aa2853
sub edx, 0x22e62320
sub dword [ebp - 4], ecx
mov edi, dword [esi]
mov dword [ebp - 8], 0x1e07df13
xor edi, edx
add dword [ebp - 8], 0xa2e32798
mov dword [ebx], edi
sub dword [ebp - 0xc], 0x1f95b82c
add ebx, 4
add esi, 0x8a9f545e
sub esi, 0x8a9f545a
loop 0x1010d899
add eax, 0xf37ce764
sub eax, 0xf37c0349
mov ebx, eax
add eax, 0x5eed01b1
add eax, 0xa112fe54
mov ecx, 0x48353e5
add ecx, 0xb7cac1b
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10110860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023e79b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102e9794]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x101108a9
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
cmp dword [0x102e354c], 0
jne 0x101108c0
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x1011090d
mov eax, dword [esi]
test eax, eax
je 0x10110892
cmp dword [esi + 4], 0
je 0x10110892
push eax
call fcn.1010d770
add esp, 4
push dword [esi + 4]
call fcn.1010d770
mov eax, dword [esi + 0xc]
add esp, 4
test eax, eax
je 0x101108fe
push eax
call fcn.1010d770
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x10110945
push eax
call fcn.1010d770
jmp 0x10110942
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call fcn.1010d770
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
call fcn.1010d770
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
call fcn.1010d770
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.1010d770
add esp, 4
push 8
call fcn.1010d770
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10110980
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1010d770
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1019c030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023ff89
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102e9794]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call sym.AIDE.dll_public:_void___thiscall_AIDE::PaletteInfo::constructor_void_
mov ecx, dword [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.1019d620
mov dword [esi], eax
lea ecx, [edi + 0x28]
mov dword [esi + 4], 3
mov dword [esi + 8], 0
mov dword [ecx], 8
mov dword [edi + 0x30], 8
mov dword [edi + 0x2c], 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 8
mov ecx, dword [edi + 0x14]
call fcn.1019d600
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10209e80
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x10209e91
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x1023bf90
movss xmm5, dword [0x102bd82c]
movss xmm4, dword [0x102bd834]
movss xmm6, dword [0x102bd828]
movss xmm7, dword [0x102bd820]
movss xmm3, dword [0x1027b890]
push esi
xor esi, esi
nop dword [eax + eax]
movd xmm0, esi
mov eax, esi
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
sub esp, 8
addsd xmm0, qword [eax*8 + 0x102d46d0]
cvtpd2ps xmm2, xmm0
movaps xmm0, xmm4
movaps xmm1, xmm2
mulss xmm1, xmm5
subss xmm0, xmm1
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010d770
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, xmm6
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010d770
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, xmm7
add ecx, eax
mov dword [esi*4 + 0x102fc9f0], ecx
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010d770
movaps xmm0, xmm2
mov edx, eax
mulss xmm0, dword [0x102bd830]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010d770
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102bd818]
add eax, edx
mov dword [esi*4 + 0x102fd1f0], eax
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010d770
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, dword [0x102bd824]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010d770
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102bd81c]
add eax, ecx
mov dword [esi*4 + 0x102fcdf0], eax
mulss xmm0, xmm3
subss xmm0, xmm4
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010d770
movaps xmm0, xmm2
mov dword [esi*4 + 0x102fd5f0], eax
mulss xmm0, dword [0x102bd83c]
mov dword [esi*4 + 0x102fddf0], edx
mov dword [esi*4 + 0x102fd9f0], ecx
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010d770
movaps xmm0, xmm2
mov dword [esi*4 + 0x102fe1f0], eax
mulss xmm0, dword [0x102bd840]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010d770
movaps xmm0, xmm2
mov dword [esi*4 + 0x102fe5f0], eax
mulss xmm0, dword [0x102bd844]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1010d770
mov dword [esi*4 + 0x102fe9f0], eax
mulss xmm2, dword [0x102bd838]
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
call fcn.1010d770
mov dword [esi*4 + 0x102fedf0], eax
add esp, 8
inc esi
cmp esi, 0x100
jb 0x1023bfc0
pop esi
ret
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x408ecc
mov ecx, 0x3e7a28bd
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, str.__r
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0xd6437cd
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x42549a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x425528
cmp dword [0x447820], 0
jne 0x4254f9
mov byte [eax], 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x6c64746e
mov dword [ebp - 0x24], 0x6c642e6c
mov word [ebp - 0x20], 0x6c
mov dword [ebp - 0x14], 0x6e73765f
mov dword [ebp - 0x10], 0x6e697270
mov word [ebp - 0xc], 0x6674
mov byte [ebp - 0xa], 0
call fcn.00427d07
pop ecx
pop ecx
mov dword [0x447820], eax
test eax, eax
je 0x425528
push edi
mov eax, esi
call 0x40bbf9
mov edi, eax
jmp 0x425510
add edi, 0x104
call fcn.00425002
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push edi
push dword [esi]
call dword [0x447820]
add esp, 0x10
test eax, eax
js 0x425505
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x425786
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
and dword [ebp - 4], 0
cmp dword [0x448860], 0
jne 0x4257e2
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x38], 0x7373
lea eax, [ebp - 0x84]
mov dword [ebp - 0x44], 0x6f577349
mov dword [ebp - 0x40], 0x50343677
mov dword [ebp - 0x3c], 0x65636f72
mov byte [ebp - 0x36], 0
mov dword [0x448860], 1
call fcn.004279cb
push eax
call fcn.00427d07
pop ecx
pop ecx
mov dword [0x448864], eax
mov eax, dword [0x448864]
test eax, eax
je 0x4257f4
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 8]
call eax
mov eax, dword [ebp - 4]
mov dword [0x44885c], eax
leave
ret

Function at 0x425994
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x190
push esi
push edi
call fcn.004295ee
cmp dword [ebp + 8], eax
jne 0x4259c1
push 0
call fcn.00429111
pop ecx
mov ecx, dword [eax + 0x3c]
movzx eax, word [ecx + eax + 0x5c]
jmp 0x425a98
push dword [ebp + 8]
xor edi, edi
push 0x410
call fcn.004293dd
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
je 0x425a8f
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00427485
add esp, 0xc
test eax, eax
jne 0x425a8f
lea eax, [esp + 8]
push eax
push 0x38
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x20]
push esi
call fcn.00429302
add esp, 0x14
test eax, eax
je 0x425a8f
cmp dword [esp + 8], edi
je 0x425a8f
lea eax, [esp + 8]
push eax
push 0x40
lea eax, [esp + 0x68]
push eax
push dword [esp + 0x3c]
push esi
call fcn.00429302
add esp, 0x14
test eax, eax
je 0x425a8f
cmp dword [esp + 8], edi
je 0x425a8f
mov eax, 0x5a4d
cmp word [esp + 0x60], ax
jne 0x425a8f
lea eax, [esp + 8]
push eax
push 0xf8
lea eax, [esp + 0xa8]
push eax
mov eax, dword [esp + 0xa8]
add eax, dword [esp + 0x3c]
push eax
push esi
call fcn.00429302
add esp, 0x14
test eax, eax
je 0x425a8f
cmp dword [esp + 8], edi
je 0x425a8f
cmp dword [esp + 0xa0], 0x4550
jne 0x425a8f
movzx edi, word [esp + 0xfc]
push esi
call fcn.00429254
pop ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x425ce7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call 0x40b3b3
mov eax, dword fs:[0x30]
add eax, 0xc
mov eax, dword [eax]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov esi, dword [eax + 0xc]
jmp 0x425dbd
push 0x104
lea eax, [esp + 0x24]
push eax
push dword [esi + 0x28]
call fcn.00428ae8
add esp, 0xc
test eax, eax
jle 0x425dbb
mov eax, dword [ebp + 0xc]
and dword [esp + 0x14], 0
cmp dword [eax + 4], 0
jbe 0x425dbb
mov edi, dword [eax]
lea ecx, [esp + 0x20]
call fcn.00424786
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edi
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
je 0x425d6e
mov ecx, eax
call fcn.00424786
mov ecx, edi
neg ecx
sbb ecx, ecx
and ecx, dword [esp + 0x10]
lea edx, [esp + 0x20]
mov ecx, dword [ecx]
mov ebx, eax
push 1
mov eax, ecx
mov ecx, dword [esp + 0x20]
push edx
call fcn.0042875f
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x425dac
inc dword [esp + 0x14]
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x14]
add dword [esp + 0x10], 4
cmp ecx, dword [eax + 4]
jb 0x425d57
jmp 0x425dbb
mov eax, dword [esi + 0x18]
push dword [esi + 0x20]
push eax
mov eax, dword [ebp + 8]
call 0x40b517
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
jne 0x425d19
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4263b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
cmp dword [ebp + 8], 0
jne 0x4263c3
xor eax, eax
leave
ret
mov dword [ebp - 0x218], 0x101a3046
mov dword [ebp - 0x1f8], 0x63634143
mov dword [ebp - 0x214], 0x310e0617
mov dword [ebp - 0x210], 0x46170c0c
mov dword [ebp - 0x20c], 0x101a103f
mov dword [ebp - 0x208], 0x500e0617
mov dword [ebp - 0x204], 0xe003f51
mov dword [ebp - 0x200], 0x1b064d07
mov dword [ebp - 0x1fc], 0x4c4306
mov byte [ebp - 0x1f6], 0x63
mov byte [ebp - 0x218], 0x25
lea eax, [ebp - 0x218]
inc eax
xor byte [eax], 0x63
jne 0x426431
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x218]
call fcn.004247c1
mov eax, 0x404f34
call fcn.004247c1
mov eax, ecx
push eax
lea eax, [ebp + 8]
call fcn.0042ce9f
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 0xc]
pop ecx
jne 0x426467
lea eax, [ebp - 0x10]
push ebx
push esi
push edi
push eax
push dword [ebp + 8]
xor ebx, ebx
xor eax, eax
call fcn.00425a9e
pop ecx
pop ecx
lea esi, [ebp + 8]
mov edi, eax
call fcn.00424fe3
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4265b8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
and dword [ebp - 0xc], 0
push ebx
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
xor ebx, ebx
mov edi, 0x104
inc ebx
jmp 0x4265ea
cmp ecx, dword [ebp + 8]
je 0x4265f3
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x4265e3
jmp 0x426627
push edi
lea ecx, [ebp - 0x118]
push ecx
push dword [eax + 0x28]
call fcn.00428ae8
add esp, 0xc
test eax, eax
je 0x426627
lea ecx, [ebp - 0x118]
call fcn.00424786
cmp eax, edi
jge 0x426627
push dword [ebp + 0xc]
mov eax, ecx
call fcn.00424760
pop ecx
mov dword [ebp - 0xc], ebx
cmp dword [0x44885c], ebx
jne 0x426716
cmp dword [ebp - 0xc], ebx
jne 0x426716
lea eax, [ebp - 4]
push esi
push eax
mov eax, 0x405810
call fcn.0043e85b
mov eax, dword [eax]
lea ecx, [ebp - 0x118]
push ecx
call fcn.00424760
pop ecx
pop ecx
lea esi, [ebp - 4]
call fcn.00424fe3
push edi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00428f42
add esp, 0xc
test eax, eax
je 0x426715
push ebx
lea ecx, [ebp - 0x21c]
call fcn.00424786
mov ecx, dword [ebp + 0xc]
mov ebx, eax
call fcn.00424786
push dword [ebp + 0xc]
mov ecx, eax
lea eax, [ebp - 0x21c]
call fcn.0042875f
pop ecx
pop ecx
test eax, eax
jne 0x426715
lea eax, [ebp - 4]
push eax
mov eax, 0x40585c
call fcn.0043e85b
mov eax, dword [eax]
lea ecx, [ebp - 0x118]
push ecx
call fcn.00424760
pop ecx
pop ecx
lea esi, [ebp - 4]
call fcn.00424fe3
push edi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00428f42
add esp, 0xc
test eax, eax
je 0x426715
lea ecx, [ebp - 0x21c]
call fcn.00424786
and dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cld
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], edi
pop esi
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
leave
ret

Function at 0x426a50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [edi + 4], 0xffffffff
push ebx
push esi
jne 0x426a60
xor eax, eax
jmp 0x426aad
push 0
push 0
push edi
call fcn.00426892
lea ebx, [edi + 0xc]
push ebx
push edi
push 0x40
pop esi
call fcn.004269ca
cmp eax, esi
jne 0x426a5c
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x426a5c
push 0
push dword [edi + 0x48]
push edi
call fcn.00426892
lea eax, [ebp - 4]
push eax
push edi
push 4
pop esi
call fcn.004269ca
cmp eax, esi
jne 0x426a5c
xor eax, eax
cmp dword [ebp - 4], 0x4550
sete al
pop esi
pop ebx
leave
ret

Function at 0x426e79
Capabilities:
Parse pe header

Disassembly:
mov ecx, 0x5a4d
xor eax, eax
cmp word [edx], cx
jne 0x426eb5
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x426eb5
test esi, esi
je 0x426e9b
lea eax, [ecx + 4]
mov dword [esi], eax
test edi, edi
je 0x426ea4
lea eax, [ecx + 0x18]
mov dword [edi], eax
test ebx, ebx
je 0x426eb2
movzx eax, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebx], eax
xor eax, eax
inc eax
ret