joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4102a0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x420b20
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x42b1d0]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push ebp
push edi
mov eax, dword [0x42b1d0]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
push 0x44
xor ebx, ebx
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.004183e0
add esp, 0xc
xor eax, eax
mov edi, 0xf
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0xa0], edi
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
mov eax, esi
mov dword [esp + 0xb4], ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x410330
sub eax, edx
push eax
push esi
lea eax, [esp + 0x90]
call fcn.00401740
push esi
push str.RunProgram_Path__s
call fcn.004124a0
mov eax, dword [esp + 0x94]
mov ebp, 0x10
add esp, 8
cmp dword [esp + 0xa0], ebp
jae 0x410371
lea eax, [esp + 0x8c]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x410432
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], edi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.00401850
mov byte [esp + 0xb4], 1
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x84], ebp
jae 0x4103d0
lea eax, [esp + 0x70]
push eax
call fcn.004124a0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FTRACE:_CreateProcess_error..._d
call fcn.004124a0
add esp, 8
cmp dword [esp + 0x84], ebp
jb 0x410403
mov ecx, dword [esp + 0x70]
push ecx
call fcn.0041288e
add esp, 4
mov dword [esp + 0x84], edi
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
cmp dword [esp + 0xa0], ebp
jb 0x41042e
mov edx, dword [esp + 0x8c]
push edx
call fcn.0041288e
add esp, 4
xor eax, eax
jmp 0x410498
cmp dword [esp + 0xbc], ebx
je 0x410458
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call edi
push esi
push str.Run__s__SUC...
call fcn.004124a0
add esp, 8
cmp dword [esp + 0xa0], ebp
jb 0x410493
mov edx, dword [esp + 0x8c]
push edx
call fcn.0041288e
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00412899
add esp, 0xa8
ret
Function at 0x4104c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x130
mov eax, dword [0x42b1d0]
xor eax, esp
mov dword [esp + 0x12c], eax
push 0x12b
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.004183e0
add esp, 0xc
push 0x12c
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x410516
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.00412899
add esp, 0x130
ret
lea eax, [esp]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410520
sub eax, edx
push eax
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.00401c30
mov ecx, dword [esp + 0x12c]
xor ecx, esp
mov eax, 1
call fcn.00412899
add esp, 0x130
ret
Function at 0x410e40
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4206fb
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x42b1d0]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42b1d0]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push 2
mov esi, ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
lea eax, [esp + 0x4c]
push eax
push ebp
mov dword [esp + 0x54], 0x128
call sub.KERNEL32.dll_Process32First
push 0x7f
lea ecx, [esp + 0x179]
push ebx
push ecx
mov edi, eax
mov byte [esp + 0x180], bl
call fcn.004183e0
push 0x7f
lea edx, [esp + 0x184]
push esi
push edx
call fcn.00413040
lea eax, [esp + 0x18c]
push eax
call fcn.00412c85
mov ecx, eax
add esp, 0x1c
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x410ef0
sub ecx, esi
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.00401c30
mov dword [esp + 0x280], ebx
cmp edi, ebx
je 0x411003
push 0x80
lea ecx, [esp + 0x178]
push ebx
push ecx
call fcn.004183e0
push 0x80
lea edx, [esp + 0x204]
push ebx
push edx
call fcn.004183e0
push 0x7f
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x214]
push ecx
call fcn.00413040
add esp, 0x24
xor eax, eax
jmp 0x410f60
mov cl, byte [esp + eax + 0x1f4]
mov byte [esp + eax + 0x174], cl
inc eax
cmp cl, bl
jne 0x410f60
lea edx, [esp + 0x174]
push edx
call fcn.00412c85
mov ecx, eax
add esp, 4
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x410f98
sub ecx, esi
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00401c30
mov ecx, dword [esp + 0x18]
mov edi, 0x10
cmp dword [esp + 0x2c], edi
jae 0x410fbf
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], edi
jae 0x410fcd
lea eax, [esp + 0x34]
push ecx
push eax
call fcn.0041fdc6
add esp, 8
test eax, eax
je 0x411048
lea eax, [esp + 0x4c]
push eax
push ebp
call sub.KERNEL32.dll_Process32Next
mov esi, eax
cmp dword [esp + 0x2c], edi
jb 0x410ffb
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0041288e
add esp, 4
cmp esi, ebx
jne 0x410f13
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x48], 0x10
jb 0x41101e
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0041288e
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.00412899
add esp, 0x270
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c], edi
jb 0x411062
mov edx, dword [esp + 0x18]
push edx
call fcn.0041288e
add esp, 4
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
cmp dword [esp + 0x48], edi
jb 0x411085
mov eax, dword [esp + 0x34]
push eax
call fcn.0041288e
add esp, 4
mov eax, 1
jmp 0x411020
Function at 0x411ab0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
cmp byte [esi + 0x2c], 0
push ebx
push edi
jne 0x411b0b
cmp byte [esi + 0x18], 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov bl, 1
jne 0x411ad8
push 0
push 0
push 0
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x411b3d
mov byte [esi + 0x18], bl
cmp byte [esi + 0x20], 0
jne 0x411af0
push 0
push 0
push 0
call edi
mov dword [esi + 0x1c], eax
test eax, eax
je 0x411b3d
mov byte [esi + 0x20], bl
cmp byte [esi + 0x28], 0
jne 0x411b08
push 0
push 0
push 0
call edi
mov dword [esi + 0x24], eax
test eax, eax
je 0x411b3d
mov byte [esi + 0x28], bl
mov byte [esi + 0x2c], bl
cmp byte [esi + 0x18], 0
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
je 0x411b1f
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push eax
call edi
cmp byte [esi + 0x10], 0
je 0x411b43
cmp byte [esi + 0x18], 0
je 0x411b35
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, 0xfffffffb
pop ebx
ret
pop edi
or eax, 0xffffffff
pop ebx
ret
cmp byte [esi + 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
je 0x411b55
mov edx, dword [esi + 0x14]
push edx
call ebx
cmp byte [esi + 0x20], 0
je 0x411b63
mov eax, dword [esi + 0x1c]
push 0xffffffffffffffff
push eax
call edi
mov eax, dword [esi + 4]
test eax, eax
je 0x411b78
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
lea ecx, [esi + 8]
push ecx
push 0
push esi
push 0x411c20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x411ba8
cmp byte [esi + 0x20], al
je 0x411ba0
mov edx, dword [esi + 0x1c]
push edx
call ebx
pop edi
mov eax, 0xfffffffe
pop ebx
ret
cmp byte [esi + 0x18], 0
je 0x411bb6
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push eax
call edi
cmp byte [esi + 0x10], 0
jne 0x411be0
lea esp, [esp]
cmp byte [esi + 0x18], 0
je 0x411bda
mov ecx, dword [esi + 0x14]
push ecx
call ebx
cmp byte [esi + 0x18], 0
je 0x411bda
mov edx, dword [esi + 0x14]
push 0xffffffffffffffff
push edx
call edi
cmp byte [esi + 0x10], 0
je 0x411bc0
cmp byte [esi + 0x18], 0
je 0x411bec
mov eax, dword [esi + 0x14]
push eax
call ebx
cmp byte [esi + 0x20], 0
je 0x411bf8
mov ecx, dword [esi + 0x1c]
push ecx
call ebx
cmp byte [esi + 0x28], 0
je 0x411c12
mov edx, dword [esi + 0x24]
push 0xffffffffffffffff
push edx
call edi
cmp byte [esi + 0x28], 0
je 0x411c12
mov eax, dword [esi + 0x24]
push eax
call ebx
pop edi
xor eax, eax
pop ebx
ret
Function at 0x4122b0
Capabilities:
Get session user name

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0
push 0x423d93
mov ecx, ebp
mov edi, 1
call fcn.00401c30
push 0x104
mov dword [esp + 0x18], 0x104
call fcn.00412870
mov ebx, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esi, eax
add esp, 4
lea eax, [esp + 0x14]
push eax
push esi
call ebx
test eax, eax
jne 0x412313
push esi
call fcn.00413164
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00412870
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
push esi
call ebx
mov edi, eax
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412318
sub eax, edx
push eax
push esi
mov ecx, ebp
call fcn.00401c30
push esi
call fcn.00413164
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x412899
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b1d0]
jne 0x4128a3
repz ret
jmp fcn.00414a46
Function at 0x41cef3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 8], eax
call fcn.0041ccc9
adc byte [ecx - 0x74997004], bl
mov eax, dword [edi + 6]
cmp ax, bx
jbe 0x41cf23
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x41cf1d
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x41cf0e
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0041ccc9
sub esi, esi
and eax, 0xa8458d6d
push eax
call fcn.0041ccd9
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0041cc8e
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x41cfb7
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
inc ebp
int 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0041ccc9
mov ah, 0x66
int 0x2c
lea eax, [ebp - 0x40]
push eax
call fcn.0041ccd9
push eax
push esi
push dword [ebp + 8]
call fcn.0041cc8e
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0041ccc9
jbe 0x41cff3
clc
mov dl, 0x8d
inc ebp
call 0x512a2dbf
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0041ccd9
push eax
push esi
push dword [ebp + 8]
call fcn.0041cc8e
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
Function at 0x41d0b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
xor eax, 0x24a345c6
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0041ccd9
push eax
push esi
push dword [ebp + 8]
call fcn.0041cc8e
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0041ccd9
push eax
push esi
push dword [ebp + 8]
call fcn.0041cc8e
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0041ccc9
sbb esp, dword [edi - 0x62779992]
jl 0x41d14e
invalid
invalid

Function at 0x41d0bf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
xor eax, 0x24a345c6
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0041ccd9
push eax
push esi
push dword [ebp + 8]
call fcn.0041cc8e
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0041ccd9
push eax
push esi
push dword [ebp + 8]
call fcn.0041cc8e
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0041ccc9
sbb esp, dword [edi - 0x62779992]
jl 0x41d14e
invalid
invalid
Function at 0x41d411
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x41d3a0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x41d3be
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x41d41c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x41d403
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x41d40c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x41d416
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x41d3f8
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x41d382
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x41ed12
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
add eax, 0xfff953e9
inc dword [ebx - 0x37b5b]
inc dword [eax]
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x41ed5f
lea eax, [ebp - 0x714]
push eax
call fcn.0041ccd9
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.0041cc8e
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x41ed6a
jmp 0x41ed6f
jmp 0x41e66b
cmp dword [ebp - 0x37c], 0
jne 0x41ee19
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041cea5
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x41ee05
lea eax, [ebp - 0x714]
push eax
call fcn.0041ccd9
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.0041cd6e
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x408ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x408cef
pop dword [ebp - 0x38]
mov eax, 0x408cef
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x1f9a3d1a
sub dword [ebp - 0x48], 0xd147f7cf
mov dword [ebp - 0x44], 0xd7b7c3b6
add dword [ebp - 0x44], 0x5a7b888f
mov dword [ebp - 0x40], 0xe4e6ca67
add dword [ebp - 0x40], 0x676579c7
mov dword [ebp - 0x3c], 0x8e5ed6c3
sub dword [ebp - 0x3c], 0x8e5ed6c3
lea eax, [ebp - 0x48]
push eax
mov eax, 0xf5eb254b
add eax, 0xa55ab01
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xb1a0d418
add dword [ebp - 0x48], 0xc2d1953e
mov dword [ebp - 0x44], 0xbc00aea2
sub dword [ebp - 0x44], 0x7a944d2d
mov dword [ebp - 0x40], 0x804dd427
add dword [ebp - 0x40], 0xe3219845
mov dword [ebp - 0x3c], 0x2b74eb66
sub dword [ebp - 0x3c], 0x2b74eb66
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xc2aaf8ff
add eax, 0x3d95d749
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3d03e
push 0
call eax
mov ecx, 0x562e
xor esi, esi
add esi, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x38]
mov ebx, 0xe428ff65
sub ebx, 0xaf490b69
xor dword [ebp - 0x10], 0x4c048621
mov edx, dword [edi]
add dword [ebp - 0x34], 0x9bc04f7e
xor edx, ebx
mov dword [ebp - 0x24], 0x90a220d2
mov dword [esi], edx
mov dword [ebp - 0x28], 0x89389ab5
add esi, 0xf8a07484
sub esi, 0xf8a07480
add edi, 0x16b22361
sub edi, 0x16b2235d
loop 0x408e02
add eax, 0x8d476e32
sub eax, 0x8d4622a7
xor ebx, ebx
add ebx, eax
add eax, 0x9c72911e
add eax, 0x638d6ee7
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x408a51
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x408a60
pop dword [ebp - 0xc]
mov eax, 0x80c49762
add eax, 0x7f7bf2fe
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xc9d0b650
sub dword [ebp - 0x1c], 0x7b7e7105
mov dword [ebp - 0x18], 0x37514067
add dword [ebp - 0x18], 0xfae20bde
mov dword [ebp - 0x14], 0xf0ee66f9
sub dword [ebp - 0x14], 0xa4a222cb
mov dword [ebp - 0x10], 0x7e5c727c
sub dword [ebp - 0x10], 0x7e5c727c
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x291b8102
sub eax, 0x28dab0ae
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x7e507d14
sub dword [ebp - 0x1c], 0x9de13be
mov dword [ebp - 0x18], 0xe59d77d9
sub dword [ebp - 0x18], 0xa4311664
mov dword [ebp - 0x14], 0x3594c150
add dword [ebp - 0x14], 0x2ddaab1c
mov dword [ebp - 0x10], 0x3a79db70
add dword [ebp - 0x10], 0xc5862490
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xde458cee
add eax, 0x21fb435e
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3cde7
push 0
call eax
mov ecx, 0x556b
mov edi, eax
mov ebx, 0x2bd3703f
sub ebx, 0x2b91c03f
add ebx, dword [ebp - 0xc]
mov edx, 0x44fdb0a5
add edx, 0x7f6d4d9c
sub dword [ebp - 4], 0x71c92220
mov esi, dword [ebx]
mov dword [ebp - 4], 0x5e2227a
add esi, edx
xor dword [ebp - 8], 0x38c2fba3
mov dword [edi], esi
sub dword [ebp - 8], 0x9cd03411
add edi, 4
add ebx, 4
loop 0x408b7c
add eax, 0x1487f
xor ebx, ebx
add ebx, eax
add eax, 0xf21a3587
add eax, 0xde5ca7e
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret