joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448050
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.5161ac6b625192f793d9bb17a099
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x448083
jmp 0x448165
lea eax, [ebp - 0x148]
push eax
push 0x458f80
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4480a9
jmp 0x448165
cmp dword [ebp - 0x258], 0
jne 0x448158
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x448112
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x4480ee
jmp 0x448165
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x448110
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x448122
push str.2ba3d85fa887735ba5dd06bd66c3f
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x448165
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x448153
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x448151
mov dword [ebp - 0x258], 1
jmp 0x448153
jmp 0x448165
jmp 0x4480a9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x448180
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.4d0f29654d39171d79b96fe396c1
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4481b3
jmp 0x448295
lea eax, [ebp - 0x148]
push eax
push 0x458fc8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4481d9
jmp 0x448295
cmp dword [ebp - 0x258], 0
jne 0x448288
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x448242
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x44821e
jmp 0x448295
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x448240
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x448252
push str.7d7fbf530af97f77fb11def5098df7
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x448295
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x448283
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x448281
mov dword [ebp - 0x258], 1
jmp 0x448283
jmp 0x448295
jmp 0x4481d9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x4483b0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.0e63b58b35e3bd49502dd519e2f1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4483e1
jmp 0x4484e5
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0x38
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0xc1
xor edx, edx
div dword [ebp - 0x20]
add edx, 0xbb
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x197
mov edx, 0x9b
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x448439
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x448459
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x448430
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x448489
jmp 0x4484e5
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x4484ad
jmp 0x4484e5
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x4484f0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x448517
jmp 0x448564
cmp dword [ebp - 4], 0xc8
jbe 0x448534
mov ecx, dword [ebp - 4]
push ecx
push str.21ed0927f86305d36e759a9b
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x448564
push str.9963a88d9bbb5e8fc5df71e773c3
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x44855a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4590a0
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x448564
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret

Function at 0x448580
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.332fddc90b8d1a6742c1f2db6f77
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4485b3
jmp 0x448695
lea eax, [ebp - 0x148]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4485d9
jmp 0x448695
cmp dword [ebp - 0x258], 0
jne 0x448688
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x448642
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x44861e
jmp 0x448695
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x448640
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x448652
push str.25d34ad3c0bda41dcf03621d34d54
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x448695
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x448683
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x448681
mov dword [ebp - 0x258], 1
jmp 0x448683
jmp 0x448695
jmp 0x4485d9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x448720
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x75
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x448747
jmp 0x448794
cmp dword [ebp - 4], 0xc9
jbe 0x448764
mov ecx, dword [ebp - 4]
push ecx
push str.0dc50c095bff57b9be13a93
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x448794
push str.f76f481fa975a3299555f7d
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x44878a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x459160
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x448794
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret

Function at 0x448840
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x58
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x448867
jmp 0x4488b1
cmp dword [ebp - 4], 0x3b
jbe 0x448881
mov ecx, dword [ebp - 4]
push ecx
push str.bc27af31f0b503a14e5746352f7576
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4488b1
push str.261b83cd35b7fd63d2f9fdc366ad
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4488a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4488b1
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x44b4f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4632c0]
jne 0x44b4fe
repz ret
jmp fcn.0044bae1
Function at 0x40180f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40181e
pop dword [ebp - 0x3c]
mov eax, 0x71377522
sub eax, 0x70f75d04
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xd4151da3
add dword [ebp - 0x4c], 0x7a3d27a8
mov dword [ebp - 0x48], 0xab785771
sub dword [ebp - 0x48], 0x79450b2c
mov dword [ebp - 0x44], 0xd6aefd9
sub dword [ebp - 0x44], 0xc11eabab
mov dword [ebp - 0x40], 0x5939d447
sub dword [ebp - 0x40], 0x5939d447
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x1755bf5
sub dword [ebp - 0x4c], 0x8d02f29f
mov dword [ebp - 0x48], 0xcbbc9324
sub dword [ebp - 0x48], 0x8a5031af
mov dword [ebp - 0x44], 0x7bd9a3cb
sub dword [ebp - 0x44], 0x186a375f
mov dword [ebp - 0x40], 0xacb009f5
add dword [ebp - 0x40], 0x534ff60b
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x423c9bbd
add eax, 0xbe04348b
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3eac9
push 0
call eax
mov ecx, 0x95d2059d
add ecx, 0x6a2e568d
xor edx, edx
add edx, eax
mov esi, 0x16eb7227
sub esi, 0x16a9c227
add esi, dword [ebp - 0x3c]
mov ebx, 0x7b134d75
add ebx, 0x59509b15
xor dword [ebp - 0x1c], esi
mov edi, dword [esi]
sub dword [ebp - 0x34], edx
add edi, ebx
add dword [ebp - 0x28], ebx
mov dword [edx], edi
add edx, 0x93c7c97c
add edx, 0x6c383688
add esi, 0xf48f0fbb
add esi, 0xb70f049
loop 0x40193d
add eax, 0xe1761c83
sub eax, 0xe174b908
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x405b29
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x405b38
pop dword [ebp - 0x24]
mov eax, 0x2825710c
sub eax, 0x27e515d4
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xca2946b
add dword [ebp - 0x34], 0x41afb0e0
mov dword [ebp - 0x30], 0x7a885c88
sub dword [ebp - 0x30], 0x48551043
mov dword [ebp - 0x2c], 0xb01b5629
add dword [ebp - 0x2c], 0x9c30ee05
mov dword [ebp - 0x28], 0xe43a061d
sub dword [ebp - 0x28], 0xe43a061d
lea eax, [ebp - 0x34]
push eax
mov eax, 0xc58f783b
add eax, 0x3ab2b839
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xe61ccaef
sub dword [ebp - 0x34], 0x71aa6199
mov dword [ebp - 0x30], 0x1462a50b
add dword [ebp - 0x30], 0x2d09bc6a
mov dword [ebp - 0x2c], 0x5eb241c5
add dword [ebp - 0x2c], 0x4bd2aa7
mov dword [ebp - 0x28], 0xce0cc7a9
sub dword [ebp - 0x28], 0xce0cc7a9
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xe4536220
sub eax, 0xe41130fc
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x42d16
push 0
call eax
mov ecx, 0x54d55b86
sub ecx, 0x54d502db
mov edi, eax
mov ebx, 0x317763ce
sub ebx, 0x31341fce
add ebx, dword [ebp - 0x24]
mov esi, 0x48c40d36
add esi, 0x367a7dd3
mov dword [ebp - 0x10], 0xf465dd94
mov edx, dword [ebx]
add dword [ebp - 0x20], 0x9f2ca312
xor edx, esi
mov dword [ebp - 0xc], 0x34735fca
mov dword [edi], edx
add dword [ebp - 0x1c], eax
add edi, 4
add ebx, 4
loop 0x405c5a
add eax, 0x3661b568
sub eax, 0x36605fe9
mov ebx, eax
add eax, 5
mov ecx, 0xcb67b0bf
sub ecx, 0xcb27b0bf
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x42db1e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42db4c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42db6a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042da88
jmp 0x42db6a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42db6a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0042da88
test edi, edi
mov eax, edi
jne 0x42db54
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x44617c]
test ecx, ecx
je 0x42dc1d
jmp 0x42db1d
ret 8

Function at 0x420ed0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
or ebp, 0xffffffff
jmp 0x420ef2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x420ef9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x420ee8
mov eax, 1
add ebx, ebx
jne 0x420f0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x420f00
jne 0x420f1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x420f00
xor ecx, ecx
sub eax, 3
jb 0x420f30
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x420fa2
mov ebp, eax
add ebx, ebx
jne 0x420f3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x420f48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x420f6c
inc ecx
add ebx, ebx
jne 0x420f58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x420f4d
jne 0x420f69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x420f4d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x420f8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x420f7d
jmp 0x420eee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x420f8c
add edi, ecx
jmp 0x420eee
pop esi
mov edi, esi
mov ecx, 0x3de
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x420faa
cmp byte [edi], 5
jne 0x420faa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x420faf
lea edi, [esi + 0x1e000]
mov eax, dword [edi]
or eax, eax
je 0x421027
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x21904]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x219cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x420fdc
mov ecx, edi
jns 0x42100b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x219d0]
or eax, eax
je 0x421021
mov dword [ebx], eax
add ebx, 4
jmp 0x420ff9
call dword [esi + 0x219d4]
popal
jmp 0x40f289
Function at 0x4033d7
Capabilities:
Inspect section memory permissions

Disassembly:
cmp eax, ebx
je 0x40363c
add eax, esi
mov dword [ebp - 0x44], eax

Function at 0x403446
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x4033f2
cmp dword [eax + 0xc], ebx
je 0x403495
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.00402e4d
fisub word [edx - 0x1e]
cmpsb byte [esi], byte es:[edi]
cmp dword [ebp + 0xc], ebx
jne 0x403421
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x40363c
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x403435
mov dword [ebp + 0x10], edi
jmp 0x40343a
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.00402e4d
and ecx, edi
sub bh, dh
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x403483
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x40345e
and eax, 0xffff
push eax
jmp 0x403462
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00402e12
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x40363c
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x403443
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x4033e4
call fcn.00402e4d
pop esi
dec ebp
jecxz 0x403510
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x403501
add eax, esi
cmp eax, dword [edi + 6]
Function at 0x4034c5
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x403501
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x4034fc
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x4034e6
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x4034ee
cmp edx, ebx
jne 0x40363c
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x4034bd
add eax, dword [eax + 4]
jmp 0x4034aa
mov dword [ebp + 0xc], ebx
jmp 0x40350c
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x403524
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x403542
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4035a0
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax], al
add byte [eax - 0x77], al
jge 0x40357f
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x403587
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x403590
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40359a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40357c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x403506
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4035ed
dec eax
je 0x4035e4
sub eax, 3
je 0x4035db
mov dword [ebp - 4], 0x40
jmp 0x40360a
mov dword [ebp - 4], 4
jmp 0x4035f0
mov dword [ebp - 4], 0x20
jmp 0x4035f0
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40363c
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4035bc
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00402e4d
lahf
iretd
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4036f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x40370e
push dword [ebp + 0x14]
call fcn.00402e12
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
test dword [ecx + edi*8 - 0x7a380001], ecx
jl 0x403713
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
push ecx
cld
invalid
jmp dword [edi]
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
invalid
jb 0x4037df
invalid
invalid
Function at 0x403b51
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x6b65b], al
inc dword [eax]
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
invalid
invalid
dec esp

Function at 0x4041d2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00402e12
add esp, 0xc
mov dword [ebp - 0x6c8], eax
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x404fe0
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00402dbe
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x40425a
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x4042a3
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x40424d
call fcn.00402e4d
outsd dx, dword [esi]
and byte [edx], 0x60
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00402e4d
sbb ah, bh
mov edx, 0xd4858db5
clc
invalid
pop edi
pop esi
pop ebx
leave
ret