joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451730
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x48aaa3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0047dcaa
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00483349
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00484865
test eax, eax
je 0x45184c
mov ecx, dword [esp + 0x3c]
call fcn.00483376
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x451810
push edi
mov ecx, esi
call fcn.004809d1
mov ecx, esi
call fcn.004519f0
cmp dword [esp + 0x38], 1
jne 0x451845
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00480b0c
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x453a30
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x453a63
push esi
call fcn.00456ba0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x453a5c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x453ae9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x453ad2
mov eax, dword [esi + 8]
test eax, eax
je 0x453a87
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x453ace
cmp eax, 2
je 0x453ad2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x453a7a
cmp eax, 3
je 0x453aad
cmp eax, 1
jne 0x453a7a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x453a7a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x453a7a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00453b10
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x453af8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00453b10
add esp, 4
pop esi
ret

Function at 0x460b90
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x460c33
test eax, eax
jbe 0x460c33
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x460c33
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x460bde
xor esi, esi
jmp 0x460be4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x460c0f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00464860
add esi, eax
push esi
mov ebx, esi
call fcn.00464860
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x460bf0
pop ebp
test edi, edi
pop edi
jne 0x460c33
test ebx, ebx
je 0x460c33
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0046c1b0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x460d75
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x460e8d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x460e8d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0047e0fc
mov esi, eax
test esi, esi
je 0x460e8d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x460e8d
mov ecx, esi
call fcn.00460ce0
cmp edi, eax
jge 0x460e8d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x460e13
mov dword [esp + 0x34], 1
jmp 0x460e6e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x460e8d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0045f4f0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x465250
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4652b6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4652b6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x465297
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4655b0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4655e8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x465c80
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x465cc9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x466140
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48b500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00465cf0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00465d70
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00465d70
lea ecx, [esi + 0xc]
call fcn.0047c65d
lea ecx, [esi + 0x10]
call fcn.0047c65d
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00467300
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00467300
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00467300
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0047c6d2
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0047c6d2
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x47eaa0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47ead8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047cb2d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047cb05
jmp 0x47eae4
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48018e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4801d0
call fcn.00485d0f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4801d0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4801c7
xor eax, eax
jmp 0x4801d8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004801de
pop edi
pop esi
pop ebx
ret 4

Function at 0x48623f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48626d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48628b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004861a5
jmp 0x48628b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48628b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004861a5
test edi, edi
mov eax, edi
jne 0x486275
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x431d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004354d8
add esp, 0xc
jae 0x431d42
add ecx, dword [esp]
sub ecx, dword [esp]
sub esi, 0
jle 0x431d4d
jo 0x431d62
pushf
sub esp, 0
jl 0x431d56
jno 0x431d58
cld
popf
xchg edx, edi
xchg edx, edi
jno 0x431d62
add eax, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.00441b22
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x431e2d
xor eax, eax
jmp 0x431eb4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00450a8a
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004354d8
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x431e57
xor eax, eax
jmp 0x431eb4
cld
jnp 0x431e77
pushf
rol esp, 0
jnp 0x431e61
popf
xchg edx, ebx
xchg edx, ebx
nop
lea edx, [edx + 0x6d31]
lea edx, [edx - 0x6d31]
jp 0x431e77
mov ebp, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.0044359d
add esp, 4
stc
rol ecx, 0xf
rol ecx, 0x11
jae 0x431e8c
xor esp, 0
jns 0x431ea9
pushf
jbe 0x431e95
js 0x431e97
cmp esp, 0x1989
popf
xchg ebx, ebx
lea esp, [esp]
jge 0x431ea6
js 0x431ea9
mov esi, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x434755
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004354d8
add esp, 0xc
sub esi, 0
xor esi, 0x1686
xor esi, 0x1686
jno 0x4347a4
pushf
add esi, dword [esp]
sub esi, dword [esp]
rol edi, 3
ror edi, 3
jmp 0x43478f
jne 0x434791
popf
lea ecx, [ecx + 0x59fe]
lea ecx, [ecx - 0x59fe]
jo 0x4347a1
jo 0x4347a4
xor eax, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
Function at 0x437fc7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.004354d8
add esp, 0xc
ror ebx, 0x18
rol ebx, 0x18
js 0x437fef
xchg esp, esp
js 0x437fec
jns 0x437fef
mov edx, 0x53f445c6
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x66
mov byte [ebp - 4], 0x4c
mov byte [ebp - 3], 0x66
mov byte [ebp - 2], 0x7a
mov byte [ebp - 1], 0
neg ebx
neg ebx
add ebx, 0x6a21
sub ebx, 0x6a21
xor eax, dword [esp]
xor eax, dword [esp]
jns 0x438044
pushf
not edi
not edi
popf
jmp 0x438041
js 0x438044
mov eax, 0x80f44d8a
jmp 0xf491084e
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
mov al, byte [ebp - 2]
sub al, 1
mov byte [ebp - 2], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 4]
sub al, 1
mov byte [ebp - 4], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 3]
sub dl, 1
mov byte [ebp - 3], dl
sub esp, 0
js 0x4380be
pushf
lea esp, [esp]
ror ebx, 0
popf
jl 0x4380b5
xchg ebx, edx
xchg ebx, edx
jo 0x4380bb
jns 0x4380be
call 0xfff165aa
dec dword [ecx + 0x7d83f045]
lock add byte [ebp + 0xa], dh
call 0x432ea7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4380d6
mov eax, 1
jmp 0x438188
lea esi, [esi + 0x31ee]
sub esi, 0x31ee
mov esp, esp
jbe 0x4380fd
pushf
add esi, 0x683e
sub esi, 0x683e
popf
jo 0x4380f8
jge 0x4380fa
ja 0x4380fd
mov esi, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00450a8a
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.004354d8
add esp, 0xc
jl 0x43811f
cmc
jl 0x43812c
jns 0x438124
jp 0x438126
jb 0x438128
jge 0x43812c
mov ebx, 0xec7d83fa
add byte [ebp + 7], dh
cmp dword [ebp - 0x14], 0
jne 0x438139
mov eax, 1
jmp 0x438188
cmp ecx, dword [esp + 8]
jns 0x438156
pushf
cmp esp, 0x5322
jb 0x438149
jnp 0x43814b
popf
xchg ecx, eax
xchg ecx, eax
xchg esp, esp
xchg edi, edi
js 0x438156
mov esi, 0x50ec458b
mov eax, dword [ebp - 0x14]
push eax
call fcn.0044359d
add esp, 4
inc eax
dec eax
jp 0x438181
pushf
shr esp, 0
rol edx, 0x15
rol edx, 0xb
add ecx, 0
cmp edi, edx
popf
xchg ecx, ecx
lea ecx, [ecx]
lea esi, [esi]
jnp 0x438181
ljmp 0x55ff:0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43b55a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004354d8
add esp, 0xc
mov edx, edx
push ebx
add ebx, 0x4d7f
ror ebx, 0x15
pop ebx
test esp, 0x7572
jg 0x43b597
jns 0x43b591
je 0x43b593
jle 0x43b597
xor eax, 0xe845c612
push ecx
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
add edx, 0x1eb8
sub edx, 0x1eb8
jg 0x43b655
nop
jp 0x43b651
jle 0x43b655
ljmp 0:0x64c8e823
call fcn.00441b22
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43b66a
xor eax, eax
jmp 0x43b6fa
jmp 0x43b66c
push ecx
add ecx, 0x5aa0
ror ecx, 0x11
pop ecx
and esp, 0xffffffff
call fcn.0043b67f
Function at 0x43ed0b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x11
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.004354d8
add esp, 0xc
ror eax, 0x1a
rol eax, 0x1a
lea ebx, [ebx + 0x6c0d]
lea ebx, [ebx - 0x6c0d]
shl eax, 0
shl edx, 0
jg 0x43ed4f
jge 0x43ed40
lea eax, [eax + 0x76b5]
lea eax, [eax - 0x76b5]
jle 0x43ed4f
mov esi, 0x48e445c6
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x12], 0x62
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6d
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x13], 0x49
mov byte [ebp - 0xe], 0x66
test esp, 0x5508
jns 0x43ed9b
jae 0x43edb3
pushf
js 0x43eda1
call fcn.0043eda6
Function at 0x441a6e
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x42b288
call fcn.004519d8
add esp, 0xc
mov byte [0x42b288], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x40a2ec
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [esp + 0x70]
test ebx, ebx
je 0x40a46c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000080
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov eax, dword [esp + 0x74]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x40a45c
mov dword [esp], ebx
call sym._GlobalLock_4
push ebp
mov esi, eax
test eax, eax
je 0x40a480
cmp dword [eax], 0x28
je 0x40a380
mov dword [esp], ebx
call sym._GlobalUnlock_4
push ebx
mov dword [esp], edi
call sym._CloseHandle_4
push esi
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov word [esp + 0x42], 0x4d42
mov dword [esp], eax
call sym.PaletteSize_char_
movzx ebp, ax
add ebp, 0x28
mov eax, dword [esi + 0x10]
dec eax
cmp eax, 1
jbe 0x40a490
mov edx, dword [esi + 8]
shl edx, 2
movzx eax, word [esi + 0xe]
imul eax, dword [esi + 4]
add eax, 0x1f
shr eax, 5
imul edx, eax
add ebp, edx
mov dword [esi + 0x14], edx
lea eax, [ebp + 0xe]
mov dword [esp + 0x44], eax
mov word [esp + 0x48], 0
mov word [esp + 0x4a], 0
mov edx, dword [esi]
mov dword [esp], esi
mov dword [esp + 0x2c], edx
call sym.PaletteSize_char_
movzx eax, ax
mov edx, dword [esp + 0x2c]
lea eax, [edx + eax + 0xe]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x10], 0
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0xe
lea eax, [esp + 0x42]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 0x2c], edx
call sym._WriteFile_20
sub esp, 0x14
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], edi
call sym._WriteFile_20
sub esp, 0x14
mov dword [esp], ebx
call sym._GlobalUnlock_4
push eax
mov dword [esp], edi
call sym._CloseHandle_4
push edx
mov ecx, dword [esp + 0x3c]
test ecx, ecx
jne 0x40a47c
mov eax, 4
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x14
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x40a461
mov dword [esp], edi
call sym._CloseHandle_4
push edi
mov eax, 3
jmp 0x40a461
add ebp, dword [esi + 0x14]
jmp 0x40a3be