joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4175cd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push esi
push edi
mov dword [ebp - 0x24], 0xf0e6e0b0
xor ecx, ecx
mov dword [ebp - 0x20], 0xfae7e5e7
mov dword [ebp - 0x1c], 0xf0f9fcf3
mov dword [ebp - 0x18], 0xf0c1c9b0
mov dword [ebp - 0x14], 0xe7f2f0f9
mov dword [ebp - 0x10], 0xd1b5f8f4
mov dword [ebp - 0xc], 0xe1fee6f0
mov dword [ebp - 8], 0xe1c9e5fa
mov dword [ebp - 4], 0xf4e1f4f1
mov al, byte [ebp + ecx - 0x24]
xor al, 0x95
movzx eax, al
mov word [ebp + ecx*2 - 0xc8], ax
inc ecx
cmp ecx, 0x24
jl 0x417619
xor eax, eax
mov dword [ebp - 0x20], 0xbbbbac70
mov word [ebp - 0x80], ax
mov dword [ebp - 0x1c], 0xacbfacaf
mov dword [ebp - 0x18], 0xb09fa770
mov dword [ebp - 0x14], 0xbdb2b0b7
mov dword [ebp - 0x10], 0x8f6bb8ac
mov dword [ebp - 0xc], 0xbfb6beb0
mov dword [ebp - 8], 0xbfa7bbba
mov dword [ebp - 4], 0xacbfacaf
movq xmm1, qword [ebp + eax - 0x20]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
psubw xmm1, xmmword [0x428f90]
pand xmm1, xmmword [0x428fb0]
movups xmmword [ebp + eax*2 - 0x78], xmm1
add eax, 8
cmp eax, 0x20
jl 0x41766e
xor eax, eax
mov word [ebp - 0x38], ax
lea eax, [ebp - 0xc8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x28], eax
mov al, byte [0x42b9d8]
add al, 0xf
mov byte [0x42b9d4], al
mov eax, dword [0x42b9ac]
add eax, 0xb20b115f
mov dword [0x42b9d8], eax
sub al, 0x3f
push 0x1000
mov byte [0x42b9c6], al
call fcn.0040570b
pop ecx
mov cl, byte [0x42b9d4]
mov edi, eax
and cl, 0xae
mov eax, 0x2ea6
mov byte [0x42b9c6], cl
movzx ecx, byte [0x42b9ce]
sub cx, ax
mov word [0x42b9b4], cx
test edi, edi
je 0x417826
mov eax, dword [0x42b9d8]
xor eax, 0xb7ca1656
xor esi, esi
mov dword [0x42b9ac], eax
movzx eax, byte [0x42b9ac]
xor ecx, ecx
sub dword [0x42b9d8], 0x284d77c5
mov edx, 0x5060ff33
imul eax, eax, 0xd1
inc ecx
push 0x800
push edi
push dword [ebp + esi*4 - 0x2c]
mov byte [0x42b9ce], al
xor al, 0x77
mov byte [0x42b9d4], al
call fcn.0041568d
call eax
test eax, eax
je 0x417803
mov al, byte [0x42b9b4]
mov edx, 0xeeb55893
mov cl, byte [0x42b9d8]
xor al, 0xc6
mov byte [0x42b9c6], al
xor cl, 0x8a
or al, 0x31
mov byte [0x42b9ce], cl
mov byte [0x42b9d4], al
movzx eax, cl
and eax, 0x7114a1c9
mov dword [0x42b9d8], eax
movzx eax, cl
mov ecx, 0x2276
and ax, cx
xor ecx, ecx
push edi
inc ecx
mov word [0x42b9b4], ax
call fcn.0041568d
call eax
imul ecx, dword [0x42b9d8], 0x8b4df9d8
mov dl, byte [0x42b9c6]
sub dl, 0xa
mov byte [0x42b9ce], dl
mov dword [0x42b9ac], ecx
movzx ecx, word [0x42b9b4]
sub ecx, 0x757ead70
mov dword [0x42b9d8], ecx
cmp eax, 0xffffffff
je 0x417803
test al, 0x10
je 0x417803
or dl, 0x75
mov byte [0x42b9d4], 0
xor dl, 0xaa
mov ecx, edi
mov byte [0x42b9c6], dl
call fcn.0041782a
inc esi
cmp esi, 2
jb 0x41771a
movzx eax, byte [0x42b9c6]
imul eax, eax, 0xc5131f63
push edi
mov dword [0x42b9ac], eax
call fcn.004056f0
pop ecx
pop edi
pop esi
leave
ret
Function at 0x41b1dc
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov word [ebp - 4], 0xa8a2
xor ecx, ecx
mov byte [ebp - 2], 0x9c
mov al, byte [ebp + ecx - 4]
sub al, 0x35
mov byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 3
jl 0x41b1ee
mov byte [ebp - 5], 0
xor ecx, ecx
mov dword [ebp - 0x14], 0x6a6f6162
mov dword [ebp - 0x10], 0x616d7c6b
mov word [ebp - 0xc], 0x6b6a
mov al, byte [ebp + ecx - 0x14]
xor al, 0xe
mov byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 0xa
jl 0x41b218
movzx eax, word [0x42bac4]
lea edx, [ebp - 0x20]
or eax, 0xfb35ca80
mov byte [ebp - 0x16], 0
mov dword [0x42baa4], eax
lea ecx, [ebp - 8]
mov eax, dword [0x42bac0]
or eax, 0x5415
mov word [0x42babc], ax
mov eax, dword [0x42bab4]
add eax, 0x26c8
push esi
mov word [0x42bac4], ax
call fcn.0041d87d
mov cx, word [0x42babc]
mov esi, eax
mov eax, 0x1a9e
add cx, ax
movzx edx, cx
mov word [0x42babc], cx
test esi, esi
je 0x41b43c
movzx ecx, word [0x42bac4]
add edx, 0x38babb45
and dword [0x42ba9c], 0x666bb37a
imul eax, ecx, 0xce0e5b41
or ecx, 0xf19160d9
mov dword [0x42bab8], ecx
mov ecx, 0x600b
push ebx
mov dword [0x42bac0], edx
mov dword [0x42baa4], eax
mov ax, word [0x42bacc]
sub ax, cx
mov word [0x42babc], ax
lea eax, [edx + 0xff984b8]
mov dword [0x42bab4], eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.00405b40
pop ecx
mov edx, eax
mov ecx, esi
call fcn.0040f780
and dword [0x42bab8], 0x9c9635d5
mov ebx, eax
pop ecx
test ebx, ebx
je 0x41b414
mov ecx, dword [0x42baa4]
mov eax, dword [0x42bac0]
and ecx, 0xba97
push edi
mov word [0x42bac4], cx
or eax, 0xa85a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
xor ecx, ecx
push ecx
push ecx
mov word [0x42babc], ax
lea eax, [ebp - 0x14]
push eax
push 0x41b43f
push ecx
push ecx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [0x42bac0]
mov edi, eax
imul ecx, edx, 0xc163
mov word [0x42bac4], cx
mov ecx, dword [0x42bab4]
add ecx, 0xffffe0d3
mov word [0x42bacc], cx
mov ecx, dword [0x42bab8]
xor ecx, 0x7f7b1ff2
mov dword [0x42bab8], ecx
test edi, edi
je 0x41b3e5
lea eax, [edx + 0x333d142d]
and ecx, 0x6f76
mov dword [0x42bab4], eax
add ecx, 0x3a9
mov eax, dword [0x42baa4]
push 0xffffffffffffffff
xor eax, 0x899
mov word [0x42babc], cx
push edi
mov word [0x42bacc], ax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 0x92b6
or ax, word [0x42bac4]
push edi
mov word [0x42babc], ax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x42bac0]
mov ecx, dword [0x42bab8]
mov eax, dword [0x42ba9c]
or eax, 0xe324667b
mov dword [0x42baa4], eax
imul eax, edx, 0x1d30
push ebx
mov word [0x42babc], ax
imul eax, ecx, 0x375f
mov word [0x42bac4], ax
call fcn.004056f0
pop ecx
pop edi
mov eax, dword [0x42baa4]
or eax, 0xb6d7c318
mov dword [0x42bab4], eax
movzx eax, word [0x42bac4]
xor eax, 0x66a78f5c
push esi
mov dword [0x42bab8], eax
call fcn.004056f0
pop ecx
pop ebx
pop esi
leave
ret
Function at 0x41cc10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
mov cx, word [0x42bb18]
mov al, cl
sub al, 0x57
mov byte [0x42bb3c], al
mov eax, 0x81c5
push esi
mov esi, edx
movzx edx, cx
mov ecx, dword [0x42bb08]
or dx, ax
mov eax, ecx
xor eax, 0x19dc761a
mov dword [0x42bb40], eax
xor eax, eax
push edi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ecx + 0x5f1f]
mov word [0x42bb18], ax
xor ecx, ecx
lea eax, [edx - 0x6c1e]
inc ecx
mov edx, 0x9e7f4339
mov word [0x42bb50], ax
call fcn.0041568d
call eax
push eax
push esi
mov edx, ebx
lea ecx, [ebp - 0x1c]
call fcn.0041d16f
movzx eax, byte [0x42bb40]
lea edx, [ebp - 4]
movzx ecx, word [0x42bb54]
xor ebx, ebx
imul eax, eax, 0xaa
mov dword [ebp - 4], ebx
or al, 0x49
mov byte [0x42bb3c], al
lea eax, [ecx - 0x4868441f]
mov dword [0x42bb40], eax
imul eax, ecx, 0x25bff6ec
lea ecx, [ebp - 0x1c]
mov dword [0x42bb08], eax
lea eax, [ebp - 8]
push eax
call fcn.0041cdcc
add esp, 0xc
test al, al
je 0x41cdb3
mov esi, dword [ebp - 4]
test esi, esi
je 0x41cdb3
mov dword [ebp - 4], 0x292e686c
mov ecx, ebx
mov al, byte [ebp + ecx - 4]
xor al, 0x23
mov byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 4
jl 0x41ccea
mov dl, byte [0x42bb54]
mov eax, 0x24e2
and dl, 0xb8
mov byte [ebp - 0xc], bl
movzx ecx, dl
imul ecx, eax
movzx eax, dl
mov edx, 0x23c1
push 4
mov word [0x42bb18], cx
imul ecx, eax, 0xdb
mov ax, word [0x42bb50]
sub ax, dx
movzx eax, ax
xor eax, 0xadd17b1e
mov dword [0x42bb08], eax
movzx eax, cl
mov byte [0x42bb3c], cl
mov ecx, 0x4cb0
add ax, cx
mov word [0x42bb50], ax
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.004022e4
add esp, 0xc
test eax, eax
jne 0x41cd9c
cmp dword [ebp - 8], 4
jb 0x41cd9c
mov eax, dword [0x42bb40]
movzx ecx, byte [0x42bb3c]
xor eax, 0xf892
mov word [0x42bb18], ax
mov eax, 0xc7cd
imul ecx, eax
mov word [0x42bb54], cx
lea ecx, [esi + 4]
call fcn.00422cc1
mov ebx, eax
imul ecx, dword [0x42bb08], 0xc077a971
push esi
mov dword [0x42bb40], ecx
call fcn.004056f0
pop ecx
mov eax, 0x9fb1
or ax, word [0x42bb54]
pop edi
mov word [0x42bb18], ax
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x41cdcc
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0xc], 0xd6d8dcc7
push edi
mov ebp, edx
mov byte [esp + 0x14], 0xdd
mov edi, ecx
mov esi, ebx
mov al, byte [esp + esi + 0x10]
xor al, 0xb3
mov byte [esp + esi + 0x18], al
inc esi
cmp esi, 5
jl 0x41cde8
imul eax, dword [0x42bb0c], 0xd5e227b3
xor ecx, ecx
mov esi, 0x42d13c
mov byte [esp + 0x1d], bl
push esi
mov edx, 0x9e7f4339
inc ecx
mov dword [0x42bb98], eax
and al, 0x7f
mov byte [0x42bb24], al
call fcn.0041568d
call eax
push eax
push esi
lea edx, [esp + 0x20]
mov ecx, edi
call fcn.0041d16f
pop ecx
pop ecx
test al, al
je 0x41ce4a
push dword [esp + 0x24]
mov edx, ebp
mov ecx, edi
call fcn.0041ce5b
pop ecx
mov bl, al
add byte [0x42bb24], 0xcf
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x41d00b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, 0x4ac6
xor ax, word [0x42bba8]
push ebx
push ebp
push esi
movzx esi, ax
mov ebp, edx
mov al, byte [0x42bb74]
lea edx, [esp + 0xc]
push edi
mov edi, ecx
or al, 2
mov ecx, 0x64df
mov byte [0x42bb6e], al
sub si, cx
xor bl, bl
mov ecx, dword [esp + 0x30]
mov word [0x42bba8], si
or esi, 0x2551
mov word [0x42bb74], si
call fcn.00423bcd
mov esi, eax
mov ecx, 0x4244
mov eax, 0x1cdc
add ax, word [0x42bba8]
movzx edx, ax
xor dx, cx
mov word [0x42bb74], dx
lea eax, [edx + 0x4205]
mov word [0x42bba8], ax
test esi, esi
je 0x41d15a
mov dword [esp + 0x14], 0x676e6b64
xor ecx, ecx
mov dword [esp + 0x18], 0x676f636c
mov al, byte [esp + ecx + 0x14]
xor al, 2
mov byte [esp + ecx + 0x1c], al
inc ecx
cmp ecx, 8
jl 0x41d0a2
movzx ecx, byte [0x42bb6e]
mov eax, 0x20c0
push dword [esp + 0x10]
and dx, ax
mov byte [esp + 0x28], bl
mov eax, 0x91ed
mov word [0x42bb74], dx
imul ecx, eax
lea edx, [esp + 0x20]
push esi
mov word [0x42bba8], cx
mov ecx, edi
call fcn.0041d16f
mov bl, al
pop ecx
pop ecx
test bl, bl
je 0x41d138
mov dword [esp + 0x10], 0xb7bebbb8
xor ecx, ecx
mov al, byte [esp + ecx + 0x10]
sub al, 0x52
mov byte [esp + ecx + 0x14], al
inc ecx
cmp ecx, 4
jl 0x41d0fd
push dword [esp + 0x2c]
mov eax, 0x45c4
mov byte [esp + 0x1c], 0
add ax, word [0x42bba8]
lea edx, [esp + 0x18]
push ebp
mov ecx, edi
mov word [0x42bb74], ax
call fcn.0041d16f
pop ecx
pop ecx
mov bl, al
movzx eax, byte [0x42bb6e]
mov ecx, 0x1262
and ax, cx
push esi
mov word [0x42bb74], ax
call fcn.004056f0
mov ax, word [0x42bba8]
pop ecx
movzx eax, al
imul eax, eax, 0x14
pop edi
pop esi
pop ebp
mov byte [0x42bb6e], al
mov al, bl
pop ebx
add esp, 0x18
ret
Function at 0x41e996
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x6876
push esi
mov byte [ebp - 6], 0x7c
mov edx, ebx
mov al, byte [ebp + edx - 8]
xor al, 0x1b
mov byte [ebp + edx - 0xc], al
inc edx
cmp edx, 3
jl 0x41e9ac
mov byte [ebp - 9], bl
mov edx, ebx
mov dword [ebp - 0x4c], 0x7c7f7570
mov dword [ebp - 0x48], 0x7a82767a
mov dword [ebp - 0x44], 0x7c7f6f3a
mov dword [ebp - 0x40], 0x7f728084
mov byte [ebp - 0x3c], 0x80
mov al, byte [ebp + edx - 0x4c]
sub al, 0xd
mov byte [ebp + edx - 0x60], al
inc edx
cmp edx, 0x11
jl 0x41e9e1
mov byte [ebp - 0x4f], bl
mov edx, ebx
mov dword [ebp - 0x38], 0x21191b1d
mov dword [ebp - 0x34], 0x2818e325
mov dword [ebp - 0x30], 0x1b292d25
mov word [ebp - 0x2c], 0x2928
mov al, byte [ebp + edx - 0x38]
add al, 0x4a
mov byte [ebp + edx - 0x4c], al
inc edx
cmp edx, 0xe
jl 0x41ea11
mov byte [ebp - 0x3e], bl
mov edx, ebx
mov dword [ebp - 0x28], 0x3e2f233e
mov dword [ebp - 0x24], 0x34322835
mov word [ebp - 0x20], 0x2835
mov al, byte [ebp + edx - 0x28]
xor al, 0x5b
mov byte [ebp + edx - 0x38], al
inc edx
cmp edx, 0xa
jl 0x41ea3a
mov byte [ebp - 0x2e], bl
mov edx, ebx
mov dword [ebp - 0x1c], 0xd9d9d4c2
mov word [ebp - 0x18], 0xc1d0
mov byte [ebp - 0x16], 0xc6
mov al, byte [ebp + edx - 0x1c]
xor al, 0xb5
mov byte [ebp + edx - 0x28], al
inc edx
cmp edx, 7
jl 0x41ea60
mov byte [ebp - 0x21], bl
mov edx, ebx
mov dword [ebp - 8], 0xe5ece9e6
mov byte [ebp - 4], 0xf3
mov al, byte [ebp + edx - 8]
add al, 0x80
mov byte [ebp + edx - 0x1c], al
inc edx
cmp edx, 5
jl 0x41ea80
mov byte [ebp - 0x17], bl
mov edx, ebx
mov dword [ebp - 8], 0x89929388
mov al, byte [ebp + edx - 8]
sub al, 0x24
mov byte [ebp + edx - 0x14], al
inc edx
cmp edx, 4
jl 0x41ea9c
mov si, word [0x42bb6c]
mov edx, 0xdc03
mov ax, si
mov byte [ebp - 0x10], bl
or ax, dx
movzx edx, ax
mov word [0x42bb1c], ax
movzx eax, si
mov ebx, eax
or ebx, 0x8b8046fe
mov dword [0x42bba0], ebx
sub ecx, 0
je 0x41eba6
sub ecx, 1
je 0x41eb88
sub ecx, 1
je 0x41eb63
sub ecx, 1
je 0x41eb46
sub ecx, 1
je 0x41eb32
sub ecx, 1
je 0x41eb0e
mov byte [0x42bb3d], bl
xor eax, eax
jmp 0x41ebc8
xor edx, 0x5b75
mov eax, 0x24a
xor si, ax
mov word [0x42bb1c], dx
mov word [0x42bb6c], si
lea edx, [ebp - 0x14]
jmp 0x41ebc0
mov eax, 0x927d
lea edx, [ebp - 0x1c]
add si, ax
mov word [0x42bb6c], si
jmp 0x41ebc0
lea eax, [edx - 0x407d]
mov word [0x42bb6c], ax
lea edx, [ebp - 0x28]
movzx eax, byte [0x42bb3d]
sub eax, 0x4a4eaa47
jmp 0x41ebbb
movzx eax, byte [0x42bb3d]
lea edx, [ebp - 0x38]
mov ecx, 0x723e
and ax, cx
mov word [0x42bb6c], ax
or eax, 0x3b7b
mov word [0x42bb1c], ax
jmp 0x41ebc0
lea eax, [edx - 0x2010]
and ebx, 0x83dc
mov word [0x42bb6c], ax
lea edx, [ebp - 0x4c]
mov word [0x42bb1c], bx
jmp 0x41ebc0
xor edx, 0x7b3e
and eax, 0x7fc3237e
mov word [0x42bb1c], dx
lea edx, [ebp - 0x60]
mov dword [0x42bba0], eax
lea ecx, [ebp - 0xc]
call fcn.0041cc10
pop esi
pop ebx
leave
ret
Function at 0x4207ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x42bc04]
sub esp, 0x144
cmp byte [0x42d250], 0
push ebx
push esi
lea eax, [edx + 0x5f5c]
mov esi, 0x42d250
push edi
mov word [0x42bbec], ax
jne 0x420990
xor ebx, ebx
mov dword [ebp - 0x10], 0x1555d48
mov dword [ebp - 0xc], 0x595d4835
mov ecx, ebx
mov dword [ebp - 8], 0x1483501
mov byte [ebp - 4], 0x18
mov al, byte [ebp + ecx - 0x10]
xor al, 0x6d
mov byte [ebp + ecx - 0x34], al
inc ecx
cmp ecx, 0xd
jl 0x4207f8
mov cl, byte [0x42bbf0]
or edx, 0x8a8d6d4a
shl cl, 4
mov al, 0x3a
sub al, cl
mov byte [ebp - 0x27], bl
mov byte [0x42bc0e], al
mov edi, 0x104
mov eax, edx
mov dword [ebp - 0x14], ebx
or eax, 0x107a6675
and edx, 0xd7af
add edx, 0x444d
mov dword [0x42bc04], eax
lea eax, [ebp - 0x140]
mov word [0x42bbec], dx
xor ecx, ecx
xorps xmm0, xmm0
push edi
push eax
mov edx, 0xd2fe083d
movlpd qword [ebp - 0xc], xmm0
inc ecx
call fcn.0041568d
call eax
movzx ecx, byte [ebp - 0x140]
test eax, eax
push 0x43
pop edx
cmove ecx, edx
mov word [ebp - 0xb], 0x5c3a
mov edx, dword [0x42bc04]
xor edx, 0x3023
mov byte [ebp - 0x140], cl
mov byte [ebp - 0xc], cl
push ebx
push ebx
lea ecx, [edx - 0x62]
mov byte [ebp - 9], bl
xor cl, 0x1c
movzx eax, cl
xor eax, 0xe9697ed4
mov dword [0x42bc04], eax
movzx eax, cl
mov ecx, 0x9ea7
or ax, cx
xor ecx, ecx
movzx eax, ax
inc ecx
mov word [0x42bbf0], ax
movzx eax, al
imul eax, eax, 0x54
push ebx
push ebx
mov byte [0x42bc0e], al
lea eax, [edx + 0x36fb]
mov word [0x42bbec], ax
mov edx, 0x980ded59
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.0041568d
call eax
lea ecx, [ebp - 0x14]
call fcn.00420785
mov dword [ebp - 0x24], eax
call fcn.00420785
call fcn.00420785
movzx edx, byte [0x42bc0e]
mov word [ebp - 0x1e], ax
mov eax, 0x3d8b
add dx, ax
mov eax, 0x7cd4
and dx, ax
mov eax, 0x5aa8
add dx, ax
mov eax, 0xe310
and dx, ax
movzx eax, dx
sub eax, 0x24693984
mov word [0x42bbec], dx
mov dword [0x42bc04], eax
lea ecx, [ebp - 0x14]
call fcn.00420785
mov byte [ebp + ebx - 0x1c], al
inc ebx
cmp ebx, 8
jl 0x420945
push dword [ebp - 0x1a]
xor eax, eax
or dl, 0x46
mov word [0x42bbf0], ax
xor ecx, ecx
movzx eax, word [ebp - 0x1e]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x34]
mov byte [0x42bc0e], dl
push eax
push edi
push esi
mov edx, 0x534fbfb6
call fcn.0041568d
call eax
mov edx, dword [0x42bc04]
add esp, 0x18
movzx ecx, word [0x42bbf0]
sub dl, 0x3a
imul ecx, ecx, 0xace4d2ba
mov eax, esi
pop edi
pop esi
mov byte [0x42bc0e], dl
pop ebx
mov dword [0x42bc04], ecx
leave
ret
Function at 0x422800
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0x7a77745f
mov dword [ebp - 8], 0x3d447479
xor ecx, ecx
mov word [ebp - 4], 0x3d6b
mov byte [ebp - 2], 0x60
mov al, byte [ebp + ecx - 0xc]
xor al, 0x18
mov byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0xb
jl 0x422826
movzx eax, byte [0x42bd07]
mov ecx, dword [0x42bcc0]
mov edx, ecx
push edi
mov edi, 0xb78f
mov byte [ebp - 0xd], 0
or ax, di
xor edx, 0xf7fa
mov word [0x42bc50], ax
movzx eax, cl
xor ecx, ecx
or eax, 0x8c
add eax, 0x20a136f4
mov dword [0x42bcc0], eax
movzx eax, dl
and edx, 0x914b
imul eax, eax, 0x5f
push 0xffffffffffffffff
push esi
mov word [0x42bcc8], dx
mov edx, 0x534fbfb6
mov byte [0x42bd07], al
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x11c]
push 0x104
push eax
call fcn.0041568d
call eax
mov al, byte [0x42bcc8]
add esp, 0x14
or al, 0x3b
xor ecx, ecx
sub al, 0x17
mov edx, 0xd6eb6ff1
mov byte [0x42bd07], al
inc ecx
mov eax, dword [0x42bcc0]
add eax, 0xffffd16e
mov word [0x42bcc8], ax
lea eax, [ebp - 0x11c]
push eax
push 0
push 0
call fcn.0041568d
call eax
mov cx, word [0x42bcc8]
mov esi, eax
mov eax, 0x9feb
and cx, ax
mov eax, 0x1feb
or cx, ax
mov word [0x42bc50], cx
pop edi
test esi, esi
je 0x422985
mov ecx, dword [0x42bcc0]
mov edx, 0x1c168a16
mov al, cl
xor al, 0x81
mov byte [0x42bd07], al
imul eax, ecx, 0xcc12
xor ecx, ecx
inc ecx
mov word [0x42bc50], ax
call fcn.0041568d
call eax
cmp eax, 0xb7
movzx eax, byte [0x42bd07]
je 0x422956
and eax, 0x5268e056
mov dword [0x42bcc0], eax
xor al, 5
mov byte [0x42bd07], al
mov eax, esi
jmp 0x422994
add dword [0x42bcc0], 0x5a7511d9
mov edx, 0xa9a1
or ax, dx
xor ecx, ecx
push esi
mov edx, 0x251af175
mov word [0x42bcc8], ax
inc ecx
call fcn.0041568d
call eax
mov cx, word [0x42bc50]
movzx eax, cx
or eax, 0x14b5e4b5
mov dword [0x42bcc0], eax
xor eax, eax
pop esi
leave
ret
Function at 0x422e7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x40], 0xabacadae
xor ecx, ecx
mov dword [ebp - 0x3c], 0xa7a8a9aa
mov dword [ebp - 0x38], 0xa3a4a5a6
mov dword [ebp - 0x34], 0xbfa0a1a2
mov dword [ebp - 0x30], 0xbbbcbdbe
mov dword [ebp - 0x2c], 0xb7b8b9ba
mov dword [ebp - 0x28], 0x8d8eb5b6
mov dword [ebp - 0x24], 0x898a8b8c
mov dword [ebp - 0x20], 0x85868788
mov dword [ebp - 0x1c], 0x81828384
mov dword [ebp - 0x18], 0x9d9e9f80
mov dword [ebp - 0x14], 0x999a9b9c
mov dword [ebp - 0x10], 0x95969798
mov dword [ebp - 0xc], 0xfcfdfeff
mov dword [ebp - 8], 0xf8f9fafb
mov word [ebp - 4], 0xf6f7
mov al, byte [ebp + ecx - 0x40]
xor al, 0xcf
mov byte [ebp + ecx - 0x80], al
inc ecx
cmp ecx, 0x3e
jl 0x422ef4
movzx eax, byte [0x42bce8]
or eax, 0x7d5fcffc
mov byte [ebp - 0x42], 0
push esi
mov dword [0x42bc3c], eax
and al, 0x16
push edi
push 0
mov byte [0x42bce8], al
call fcn.00405e33
push eax
call fcn.00405e21
pop ecx
pop ecx
mov cl, byte [0x42bce8]
and cl, 0xa6
xor edi, edi
movzx eax, cl
add cl, 7
add eax, 0xbd7e9c9
mov byte [0x42bce8], cl
mov dword [0x42bc3c], eax
lea eax, [ebp - 0x80]
push eax
call fcn.00405b40
pop ecx
mov esi, eax
call fcn.00405e00
xor edx, edx
mov cl, byte [0x42bce8]
div esi
mov al, byte [ebp + edx - 0x80]
mov byte [edi + 0x42d020], al
inc edi
cmp edi, 0x14
jb 0x422f3c
movzx eax, cl
sub cl, 3
or eax, 0x41b9bef4
mov byte [0x42d034], 0
and cl, 0xed
mov dword [0x42bc3c], eax
pop edi
mov byte [0x42bce8], cl
pop esi
leave
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x52cb4620
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x1dd927f8
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40abd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x47741c], eax
pop edi
pop esi
pop ebp
ret

Function at 0x40ac70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x43d100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x38], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + ecx + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x30], 0
xor edx, edx
mov word [ebp - 0x20], dx
mov dword [ebp - 0x24], 0
jmp 0x40ace2
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x3c]
jae 0x40ad5e
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00403b60
push 0x14d
lea edx, [ebp - 0x1c]
push edx
call fcn.0040b250
add esp, 8
cmp eax, dword [ebp + 0xc]
jne 0x40ad48
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x24]
mov edx, dword [ebp - 0x24]
mov ax, word [ecx + edx*2]
mov word [ebp - 0x20], ax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
movzx eax, word [ebp - 0x20]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x1c]
call fcn.00405300
jmp 0x40ad5e
mov edx, dword [ebp - 0x2c]
add edx, 4
mov dword [ebp - 0x2c], edx
lea ecx, [ebp - 0x1c]
call fcn.00405300
jmp 0x40acd9
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410f96
mov esp, ebp
pop ebp
ret
Function at 0x4115e1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x411620
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x411620
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x411620
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x411620
cmp dword [ecx + 0x74], 0xe
jbe 0x411620
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41e15c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4323c8
push 0x4323c0
push str.FlsAlloc
push 0x1e
call fcn.0041dfc9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41e190
push dword [ebp + 8]
mov ecx, esi
call dword [0x42e194]
call esi
jmp 0x41e196
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41e1da
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4323d8
push 0x4323d0
push str.FlsGetValue
push 0x20
call fcn.0041dfc9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41e211
push dword [ebp + 8]
mov ecx, esi
call dword [0x42e194]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x420cf8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042099a

Function at 0x420d03
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00420b29