joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c130
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006839e
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x1008600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100881b4]
test eax, eax
je 0x1000c17a
inc dword [eax + 0x374]
push 0x3bf8
call fcn.100501ef
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x11]
add esp, 4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1000c1ad
push ecx
mov ecx, eax
call fcn.10007d00
mov edi, eax
mov dword [ebp - 0x18], eax
jmp 0x1000c1b2
xor edi, edi
mov dword [ebp - 0x18], edi
mov eax, dword [0x100881b4]
mov esi, 0x1007cf05
test eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], str.Window
cmove eax, edi
or edx, 0xffffffff
mov dword [0x100881b4], eax
or edi, 0xffffffff
mov al, 0x57
nop dword [eax]
cmp al, 0x23
jne 0x1000c1ee
cmp byte [esi], al
jne 0x1000c1ee
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10078c48]
test al, al
jne 0x1000c1e0
mov edi, dword [ebp - 0x18]
not edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], 0x10019110
mov dword [ebp - 0x2c], 0x100191b0
mov esi, dword [edi + 0x2db0]
mov ecx, dword [edi + 0x2db4]
mov dword [ebp - 0x28], 0x10019280
cmp esi, ecx
jne 0x1000c2c6
inc esi
test ecx, ecx
je 0x1000c248
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1000c24d
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x1000c2c6
mov eax, dword [0x100881b4]
test eax, eax
je 0x1000c265
inc dword [eax + 0x374]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call fcn.100501ef
mov edx, eax
add esp, 4
mov eax, dword [edi + 0x2db8]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1000c2ba
mov ecx, dword [edi + 0x2db0]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push edx
call fcn.10044fa0
mov eax, dword [0x100881b4]
add esp, 0xc
test eax, eax
je 0x1000c2ac
dec dword [eax + 0x374]
push dword [ebp - 0x18]
call fcn.10048e5d
mov edx, dword [ebp - 0x1c]
add esp, 4
mov dword [edi + 0x2db8], edx
mov dword [edi + 0x2db4], esi
mov eax, dword [edi + 0x2db0]
movups xmm0, xmmword [ebp - 0x38]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2db8]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 0x28]
movq qword [eax + ecx*8 + 0x10], xmm0
mov eax, edi
inc dword [edi + 0x2db0]
mov byte [edi], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1000ec50
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1000ec8f
cmp bl, 0x23
jne 0x1000ec71
cmp byte [esi], bl
jne 0x1000ec71
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10078c48]
test bl, bl
jne 0x1000ec62
mov ebx, dword [0x100881b4]
not eax
mov esi, dword [ebx + 0x19f0]
mov edi, dword [ebx + 0x19f8]
mov ecx, edi
test esi, esi
je 0x1000ecd4
nop dword [eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x1000ecc8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1000ecca
mov esi, edx
test esi, esi
jne 0x1000ecb0
mov ecx, dword [ebx + 0x19f8]
mov edx, dword [ebx + 0x19f0]
lea ecx, [ecx + edx*8]
cmp edi, ecx
je 0x1000ecec
cmp dword [edi], eax
jne 0x1000ecec
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10018a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x100881b4]
push edi
cmp byte [esi + 0x2dc8], 0
je 0x10018ace
cmp dword [esi + 0x2dd0], 0
lea edi, [esi + 0x2dd4]
je 0x10018ac0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10018a79
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10019d60
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.10009b10
mov edx, dword [edi]
mov ecx, 0x10088153
push dword [esi + 0x2dd0]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2ddc]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call fcn.10048bf5
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.10009b10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10018e10
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, edx
mov edx, dword [0x100881b4]
mov dword [ebp - 0xc], edx
push edi
mov edi, ecx
test esi, esi
jne 0x10018e39
mov esi, edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x10018e30
sub esi, ecx
test edx, edx
je 0x10018e43
inc dword [edx + 0x374]
lea eax, [esi + 1]
push ebx
push eax
call fcn.100501ef
push esi
push edi
push eax
lea ebx, [eax + esi]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
call fcn.10044fa0
mov esi, dword [ebp - 0x10]
xor edx, edx
add esp, 0x10
mov byte [ebx], 0
xor edi, edi
mov dword [ebp - 4], edx
mov ecx, esi
cmp esi, ebx
jae 0x10018fdc
nop dword [eax + eax]
mov al, byte [ecx]
cmp al, 0xa
je 0x10019009
cmp al, 0xd
je 0x10019009
mov esi, ecx
cmp ecx, ebx
jae 0x10018ea7
mov al, byte [esi]
cmp al, 0xa
je 0x10018ea7
cmp al, 0xd
je 0x10018ea7
inc esi
cmp esi, ebx
jb 0x10018e98
mov byte [esi], 0
mov al, byte [ecx]
cmp al, 0x3b
je 0x10018fce
cmp al, 0x5b
jne 0x10018fad
cmp esi, ecx
jbe 0x10018fad
cmp byte [esi - 1], 0x5d
lea ebx, [esi - 1]
jne 0x10018faa
inc ecx
mov byte [ebx], 0
mov eax, ebx
mov dword [ebp - 0x18], ecx
sub eax, ecx
push eax
push 0x5d
push ecx
call fcn.10045ab0
add esp, 0xc
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10018fc8
lea ecx, [eax + 1]
sub ebx, ecx
push ebx
push 0x5b
push ecx
call fcn.10045ab0
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x10018fc8
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov ebx, dword [0x100881b4]
mov byte [eax], 0
lea eax, [ecx + 1]
mov cl, byte [edi]
inc edi
mov dword [ebp - 0x14], eax
or eax, 0xffffffff
test cl, cl
je 0x10018f5e
or ebx, 0xffffffff
cmp cl, 0x23
jne 0x10018f3f
cmp byte [edi], cl
jne 0x10018f3f
cmp byte [edi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [edi]
inc edi
xor eax, dword [edx*4 + 0x10078c48]
test cl, cl
jne 0x10018f30
mov ebx, dword [0x100881b4]
mov edi, dword [ebx + 0x2db0]
xor ecx, ecx
not eax
test edi, edi
jle 0x10018f81
mov ebx, dword [ebx + 0x2db8]
lea edx, [ebx + 4]
cmp dword [edx], eax
je 0x10018f8a
inc ecx
add edx, 0x18
cmp ecx, edi
jl 0x10018f75
xor edi, edi
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x10018fcb
lea eax, [ecx + ecx*2]
lea edi, [ebx + eax*8]
test edi, edi
je 0x10018f83
push dword [ebp - 0x14]
mov eax, dword [edi + 8]
push edi
push dword [ebp - 0xc]
call eax
mov edx, eax
add esp, 0xc
mov dword [ebp - 4], edx
jmp 0x10018fcb
mov ebx, dword [ebp - 8]
test edi, edi
je 0x10018fce
test edx, edx
je 0x10018fce
mov eax, dword [edi + 0xc]
push ecx
push edx
push edi
push dword [ebp - 0xc]
call eax
mov edx, dword [ebp - 4]
add esp, 0x10
jmp 0x10018fce
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
lea ecx, [esi + 1]
cmp ecx, ebx
jb 0x10018e80
mov esi, dword [ebp - 0x10]
pop ebx
test esi, esi
je 0x10018ff0
mov eax, dword [0x100881b4]
test eax, eax
je 0x10018ff0
dec dword [eax + 0x374]
push esi
call fcn.10048e5d
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
mov byte [eax + 0x2d9c], 1
pop esi
mov esp, ebp
pop ebp
ret
inc ecx
jmp 0x10018e80
Function at 0x10019010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [0x100881b4]
mov eax, ecx
mov dword [ebp - 8], eax
push edi
mov dword [esi + 0x2da0], 0
test eax, eax
je 0x10019106
lea edi, [esi + 0x2da4]
mov dword [esi + 0x2da0], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10019068
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10019d60
mov ecx, dword [edi + 4]
xor edx, edx
mov dword [edi], 0
test ecx, ecx
jne 0x1001907f
push 8
mov ecx, edi
call fcn.10019d60
mov edx, dword [edi]
mov eax, dword [edi + 8]
mov dword [ebp - 4], 0
mov byte [edx + eax], 0
inc dword [edi]
cmp dword [esi + 0x2db0], 0
mov ebx, dword [edi]
jle 0x100190c7
xor ebx, ebx
nop dword [eax]
mov eax, dword [esi + 0x2db8]
add eax, ebx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x2db0]
jl 0x100190a0
mov ebx, dword [edi]
mov ecx, dword [ebp - 8]
lea eax, [ebx - 1]
neg ebx
mov edi, 0x10088153
mov edx, 0x1007cfc0
sbb ebx, ebx
and ebx, eax
mov eax, dword [esi + 0x2dac]
test eax, eax
cmovne edi, eax
call fcn.10009460
mov esi, eax
test esi, esi
je 0x10019106
push esi
push ebx
push 1
push edi
call fcn.10048bf5
push esi
call fcn.100485e6
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002bb20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
push edi
mov edi, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ecx
test edi, edi
js 0x1002bb80
cmp edi, esi
jge 0x1002bb80
xor esi, esi
mov edx, ecx
cmp byte [ecx], al
je 0x1002bb77
cmp edi, esi
je 0x1002bb75
mov ecx, edx
lea ebx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002bb60
sub ecx, ebx
inc edx
add edx, ecx
inc esi
cmp byte [edx], al
jne 0x1002bb56
xor eax, eax
jmp 0x1002bb7d
xor eax, eax
cmp byte [edx], 0
cmovne eax, edx
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov edx, eax
push 0
call fcn.1002afc0
add esp, 4
test al, al
jne 0x1002bba4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10041a84
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov byte [ebp - 9], 0
test esi, esi
jle 0x1002bc95
mov eax, dword [0x100881b4]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
nop dword [eax]
mov eax, dword [eax + 0x1a00]
lea esi, [ebp - 8]
add eax, 0xbc
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], eax
mov edi, 4
mov ecx, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10078c48]
sub edi, 1
jne 0x1002bbe4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
not edx
push eax
mov dword [ebp - 8], edx
call fcn.100197c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov esi, ecx
mov edi, dword [eax]
cmp ebx, edi
mov dword [ebp - 8], edi
sete ah
xor edx, edx
cmp byte [ecx], dl
je 0x1002bc49
cmp ebx, edx
je 0x1002bc46
mov ecx, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002bc30
sub ecx, edi
inc esi
add esi, ecx
inc edx
cmp byte [esi], al
jne 0x1002bc27
mov edi, dword [ebp - 8]
jmp 0x1002bc4e
mov edi, dword [ebp - 8]
cmp byte [esi], 0
jne 0x1002bc53
mov esi, str.Unknown_item
lea ecx, [ebp - 0x20]
mov dl, ah
push ecx
push ecx
mov ecx, esi
call fcn.10031330
add esp, 8
test al, al
je 0x1002bc71
mov eax, dword [ebp - 0x10]
mov byte [ebp - 9], 1
mov dword [eax], ebx
cmp ebx, edi
jne 0x1002bc7a
call fcn.10014290
mov eax, dword [0x100881b4]
inc ebx
mov ecx, dword [eax + 0x1a00]
dec dword [ecx + 0xbc]
cmp ebx, dword [ebp + 0x10]
jl 0x1002bbc0
call fcn.100156c0
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 9]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10041a84
mov esp, ebp
pop ebp
ret
Function at 0x10032440
Capabilities:
Hash data with crc32

Disassembly:
test dword [ecx + 0x54], 0x100000
push esi
push edi
mov edi, edx
je 0x100324b0
mov cl, byte [edi]
lea esi, [edi + 1]
or eax, 0xffffffff
test cl, cl
je 0x10032488
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x1003246f
cmp byte [esi], cl
jne 0x1003246f
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10078c48]
test cl, cl
jne 0x10032460
mov ecx, dword [0x100881b4]
not eax
cmp dword [ecx + 0x1a34], eax
jne 0x1003249e
mov dword [ecx + 0x1a38], eax
cmp dword [ecx + 0x1a6c], eax
jne 0x100324f5
pop edi
mov byte [ecx + 0x1a70], 1
pop esi
ret
mov esi, dword [0x100881b4]
xor edx, edx
mov eax, dword [esi + 0x1a00]
mov ecx, dword [eax + 0xbc]
mov eax, dword [eax + 0xc4]
push dword [eax + ecx*4 - 4]
mov ecx, edi
call fcn.100093d0
add esp, 4
cmp dword [esi + 0x1a34], eax
jne 0x100324e6
mov dword [esi + 0x1a38], eax
cmp dword [esi + 0x1a6c], eax
jne 0x100324f5
mov byte [esi + 0x1a70], 1
pop edi
pop esi
ret
Function at 0x1005574d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100555c3
Function at 0x64002970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6401c014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x6401cf28]
push edi
xor edi, edi
test esi, esi
jne 0x64002a70
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x20c]
push str._sdriversetchosts
push edx
call fcn.64004b03
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
lea esi, [ebp - 0x210]
call fcn.64002550
test eax, eax
jne 0x64002ab0
mov esi, dword [ebp - 0x210]
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.64001b20
test eax, eax
jne 0x64002a2b
mov edi, dword [ebp - 0x210]
call fcn.64001930
test eax, eax
je 0x64002a13
mov ecx, dword [0x6401cf28]
mov dword [edi + 0x10], ecx
mov dword [0x6401cf28], edi
jmp 0x64002a1a
mov eax, edi
call fcn.64001a60
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.64001b20
test eax, eax
je 0x640029f3
mov eax, dword [esi + 4]
test eax, eax
je 0x64002a42
push eax
call fcn.64003b3b
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x64002a59
push eax
call fcn.640041a3
add esp, 4
mov dword [esi + 8], 0
push esi
call fcn.64003b3b
mov esi, dword [0x6401cf28]
add esp, 4
test esi, esi
je 0x64002a85
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ecx, esi
call fcn.64001990
test eax, eax
jne 0x64002a99
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x64002a70
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4

Function at 0x640072bb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + edi*8 - 1], ecx
dec dword [ecx - 0x311707bb]
std
invalid
Function at 0x64007370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + edi*8 - 1], esi
dec dword [ebx - 0xe0807bb]
test edx, edx
je 0x64007384
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.64007096
jns 0x640073d9
in al, dx
popal
lea eax, [ebp - 0x40]
push eax
call fcn.640070a6
push eax
push esi
push dword [ebp + 8]
call fcn.6400705b
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.64007096
fild qword [ebp + 0x458d9c07]
call 0xb4e8d18c
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x64007d75
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xfffffc
je 0x64007f54
cmp dword [ebp + 0xc], 1
je 0x64007f54
cmp dword [ebp + 0xc], 8
jne 0x64007f1c
and byte [ebp - 0x6b8], 0
invalid
movsd dword es:[edi], dword [esi]

Function at 0x6400846d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 5], ch
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
call dword [eax - 0x18]
jge 0x64008473
invalid
inc dword [ebx - 0x5a7cf33c]
add cl, bh
invalid
inc dword [eax]
jmp 0x640084a3
Function at 0x40afc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
push ecx
nop
push edx
push ebx
push esp
push ebp
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
Function at 0x40b504
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40fd30
call fcn.0040b7c8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40b564
cmp eax, 0xffffffff
je 0x40b564
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40b55d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40b55d
cmp edx, 0x10000000
jae 0x40b55d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40b55a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40b5d0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40b60e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40b606
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40b610
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40b5f6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40b6e0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40b711
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40b711
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40b711
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40ddf8
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x4116f4]
push edi
mov edi, edx
test edi, edi
je 0x40de47
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40de46
and dword [ebp - 4], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 2
lea eax, [ebp - 4]
push 0
push eax
jne 0x40de3a
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x40de46
lea eax, [esi + esi]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x40e75f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x411368]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x411930]
jne 0x40e7fb
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 6
push eax
push 1
xor edi, edi
push edi
push 0x406cf0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e7fa
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x406da8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x40e7fa
push 3
push dword [edi*8 + 0x401790]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x40e7ec
inc edi
cmp edi, 0x1c
jb 0x40e7ca
jmp 0x40e7fa
mov ax, word [edi*8 + 0x401794]
mov word [0x411930], ax
pop edi
mov ecx, dword [ebp - 4]
mov ax, word [0x411930]
xor ecx, ebp
call fcn.0040afd0
leave
ret

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push 0xe8400
push 0
call sub.user32.dll_GetActiveWindow
call sub.kernel32.dll_VirtualAlloc
call fcn.004a109b
ret
Function at 0x413210
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
in al, dx
add ebp, 0x24
push esp
call fcn.0041106f
jo 0x41324f
mov dh, 0x3e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x413233
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0041106f
sbb si, dx
dec eax
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0041106f
mov al, byte cs:[0x8b49d695]
xor al, 0x8b
pop edx
and byte [ebx], al
fucompi st(0)
pop ss
fdivp st(7)
jmp [esi]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x41325c
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x41325c
call fcn.0041106f
in eax, 0xf4
cmp eax, dword [ebp - 0x75]
pop edx
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0041106f
stosd dword es:[edi], eax
ljmp 0xff08