joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442000
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x442033
push esi
call fcn.004450f0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44202c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4420b9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4420a2
mov eax, dword [esi + 8]
test eax, eax
je 0x442057
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44209e
cmp eax, 2
je 0x4420a2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44204a
cmp eax, 3
je 0x44207d
cmp eax, 1
jne 0x44204a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44204a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44204a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004420e0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4420c8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004420e0
add esp, 4
pop esi
ret

Function at 0x46064a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x460682
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045e6fe
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045e6d6
jmp 0x46068e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x461d38
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x461d7a
call fcn.004677f1
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x461d7a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x461d71
xor eax, eax
jmp 0x461d82
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00461d88
pop edi
pop esi
pop ebx
ret 4

Function at 0x467d21
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x467d4f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x467d6d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00467c87
jmp 0x467d6d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x467d6d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00467c87
test edi, edi
mov eax, edi
jne 0x467d57
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40a9b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4784b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
push 0xc
mov dword [esp + 0x10], esi
mov dword [esi], 0x40130c
mov dword [esi + 4], 0x401308
mov byte [esi + 0xc], al
call fcn.0046e7cc
xor ebx, ebx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebx
push 0x19018
mov dword [esp + 0x2c], ebx
mov dword [esi], 0x401300
mov dword [esi + 4], 0x4012fc
mov dword [esi + 0x1c], ebx
mov byte [esi + 0x30], bl
call fcn.0046e7cc
add esp, 8
mov dword [esp + 0x10], eax
cmp eax, ebx
mov byte [esp + 0x24], 1
je 0x40aa32
mov ecx, eax
call fcn.00418ac0
jmp 0x40aa34
xor eax, eax
push ebx
push ebx
push ebx
push ebx
mov byte [esp + 0x34], bl
mov dword [esi + 0x28], eax
call dword [0x48376c]
push ebx
mov dword [esi + 8], eax
call fcn.00bea1ad
push ecx
test eax, eax
jl 0x40aaa8
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x80000000
lea ecx, [esp + 0x38]
push 0x483788
mov al, 0x37
push ecx
push ebx
mov byte [esp + 0x44], 0x23
mov byte [esp + 0x45], 0x33
mov byte [esp + 0x46], 0x32
mov byte [esp + 0x47], al
mov byte [esp + 0x48], al
mov byte [esp + 0x49], 0x30
mov byte [esp + 0x4a], bl
call dword [0x480a98]
mov dword [esi + 0x34], eax
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x3c], ebx
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x40ad40
Capabilities:
Enumerate devices by category

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4784eb
push eax
mov dword fs:[0], esp
sub esp, 0x824
lea eax, [esp + 0xc]
push ebp
push eax
xor ebp, ebp
push 0x40141c
push 1
push ebp
push 0x4014ac
call int.00bea442
cwde
test eax, eax
je 0x40ad82
or eax, 0xffffffff
jmp 0x40aeb3
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
lea edx, [esp + 4]
push 0
push edx
mov ecx, dword [eax]
push 0x40149c
push eax
mov dword [esp + 0x840], 0
call dword [ecx + 0xc]
test eax, eax
je 0x40add0
mov eax, dword [esp + 4]
mov dword [esp + 0x830], 0xffffffff
test eax, eax
je 0x40adc8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or eax, 0xffffffff
jmp 0x40aeb3
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0xc]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x40ae98
push esi
call fcn.00bea54f
cmpsd dword [esi], dword es:[edi]
push edi
call fcn.00bea703
and dword [ebx - 0x72efdbbc], ecx
push esp
and al, 0x14
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x40900c
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x40ae6e
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push 0
mov word [esp + 0x24], 8
mov ecx, dword [eax]
push edx
push 0x47b3e4
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x40ae64
mov ecx, dword [esp + 0x28]
push eax
push eax
lea eax, [esp + 0x38]
push 0x800
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
inc ebp
call esi
mov edx, dword [esp + 0x28]
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x40ae06
pop edi
pop esi
mov eax, dword [esp + 4]
mov dword [esp + 0x830], 0xffffffff
test eax, eax
je 0x40aeb1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebp
mov ecx, dword [esp + 0x828]
pop ebp
mov dword fs:[0], ecx
add esp, 0x830
ret 4
Function at 0x40ce00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x130
push esi
mov esi, ecx
mov dl, 0x44
mov cl, 0x73
mov byte [esp + 7], dl
mov byte [esp + 0x1e], dl
mov al, 0x61
mov byte [esp + 6], cl
mov byte [esp + 0x10], cl
mov byte [esp + 0x13], cl
mov byte [esp + 0x1d], cl
mov dl, 0x65
mov byte [esp + 0x2f], cl
push edi
mov ecx, esi
mov byte [esp + 8], 0x52
mov byte [esp + 9], al
mov byte [esp + 0xc], 0x69
mov byte [esp + 0xd], al
mov byte [esp + 0xe], 0x6c
mov byte [esp + 0xf], 0x50
mov byte [esp + 0x10], al
mov byte [esp + 0x11], 0x72
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 0x6d
mov byte [esp + 0x15], 0x21
mov byte [esp + 0x16], 0x25
mov byte [esp + 0x18], 0x23
mov byte [esp + 0x19], 0x30
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1c], 0x4c
mov byte [esp + 0x1d], 0x24
mov byte [esp + 0x1e], 0x5f
mov byte [esp + 0x1f], 0x52
mov byte [esp + 0x20], al
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], 0x66
mov byte [esp + 0x25], al
mov byte [esp + 0x26], 0x75
mov byte [esp + 0x27], 0x6c
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x29], 0x43
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2c], 0x64
mov byte [esp + 0x2d], dl
mov byte [esp + 0x2e], 0x6e
mov byte [esp + 0x2f], 0x74
mov byte [esp + 0x30], 0x69
mov byte [esp + 0x31], al
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x34], 0x23
mov byte [esp + 0x35], 0x30
mov byte [esp + 0x36], 0
call fcn.0040cae0
push eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x3c]
push eax
push ecx
call dword [fcn.00480ac8]
add esp, 0xc
lea edx, [esp + 0x38]
mov ecx, esi
push edx
call fcn.0040cbe0
mov edi, eax
test edi, edi
je 0x40cf2c
mov ax, word [edi]
mov ecx, dword [edi + 4]
push eax
push ecx
mov ecx, esi
call fcn.0040cc70
mov edx, dword [edi + 4]
push edx
call fcn.00bec4ed
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.0040cbe0
mov edi, eax
test edi, edi
je 0x40cf56
mov cx, word [edi]
mov edx, dword [edi + 4]
push ecx
push edx
mov ecx, esi
call fcn.0040cc70
mov eax, dword [edi + 4]
push eax
call fcn.00bec4ed
pop edi
pop esi
add esp, 0x130
ret
Function at 0x4105f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x64
push esi
push edi
mov edi, dword [esp + 0x70]
push 0x2f
push edi
call fcn.0046f4d0
mov esi, eax
add esp, 8
inc esi
jne 0x410611
pop edi
xor al, al
pop esi
add esp, 0x64
ret
push esi
push edi
call fcn.00418180
add esp, 8
test al, al
jne 0x410625
pop edi
pop esi
add esp, 0x64
ret
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x2c]
mov edx, 0x44
rep stosd dword es:[edi], eax
mov cl, 0x74
mov dword [esp + 0x28], edx
mov byte [esp + 0xc], cl
mov byte [esp + 0x16], cl
mov byte [esp + 0x10], dl
lea ecx, [esp + 0x18]
lea edx, [esp + 0x28]
push ecx
push edx
push 0
push 0
push 0
mov al, 0x61
push 0
push 0
mov byte [esp + 0x29], al
mov byte [esp + 0x2f], al
push 0
lea eax, [esp + 0x28]
push 0
push esi
mov byte [esp + 0x30], 0x57
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x32], 0x6e
mov byte [esp + 0x33], 0x53
mov byte [esp + 0x36], 0x30
mov byte [esp + 0x37], 0x5c
mov byte [esp + 0x39], 0x65
mov byte [esp + 0x3a], 0x66
mov byte [esp + 0x3c], 0x75
mov byte [esp + 0x3d], 0x6c
mov byte [esp + 0x3f], 0
mov dword [esp + 0x58], eax
call fcn.00bedbdb
inc edx
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x64
ret
Function at 0x4106c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1a4
or ecx, 0xffffffff
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x1b0]
push edi
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x410903
mov al, 0x6f
mov cl, 0x70
mov byte [esp + 0x29], al
mov byte [esp + 0x32], al
mov byte [esp + 0x40], al
mov byte [esp + 0x46], al
mov al, 0x6d
mov byte [esp + 0x21], cl
mov byte [esp + 0x22], cl
mov byte [esp + 0x30], cl
mov byte [esp + 0x41], cl
mov byte [esp + 0x47], al
mov byte [esp + 0x48], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xac]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x50]
lea ecx, [esp + 0x20]
push eax
push 0xf003f
push 0
mov bl, 0x65
mov dl, 0x78
push ecx
push 0x80000000
mov byte [esp + 0x34], 0x41
mov byte [esp + 0x37], 0x6c
mov byte [esp + 0x38], 0x69
mov byte [esp + 0x39], 0x63
mov byte [esp + 0x3a], 0x61
mov byte [esp + 0x3b], 0x74
mov byte [esp + 0x3c], 0x69
mov byte [esp + 0x3e], 0x6e
mov byte [esp + 0x3f], 0x73
mov byte [esp + 0x40], 0x5c
mov byte [esp + 0x41], 0x69
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], dl
mov byte [esp + 0x45], 0x6c
mov byte [esp + 0x47], 0x72
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], 0x2e
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], dl
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], 0x5c
mov byte [esp + 0x4e], 0x73
mov byte [esp + 0x4f], 0x68
mov byte [esp + 0x50], bl
mov byte [esp + 0x51], 0x6c
mov byte [esp + 0x52], 0x6c
mov byte [esp + 0x53], 0x5c
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], 0x6e
mov byte [esp + 0x58], 0x5c
mov byte [esp + 0x59], 0x63
mov byte [esp + 0x5d], 0x61
mov byte [esp + 0x5e], 0x6e
mov byte [esp + 0x5f], 0x64
mov byte [esp + 0x60], 0
mov dword [esp + 0x68], 0x104
call fcn.00bef1b8
pop dword [ebp + 0xc850fc0]
add dword [eax], eax
add byte [ebx - 0x72afdbb4], cl
push esp
and al, 0x54
lea eax, [esp + 0xac]
push edx
push eax
push 0
push ecx
call fcn.00bef30c
push ebp
mov edx, dword [esp + 0x50]
push edx
call fcn.00bef3c7
cmpsd dword [esi], dword es:[edi]
lea eax, [esp + 0xac]
push eax
call fcn.00beb8a3
int3
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x1a4
ret
Function at 0x410910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov al, 0x70
mov cl, 0x69
mov byte [esp + 0x15], al
mov byte [esp + 0x16], al
mov byte [esp + 0x18], cl
mov byte [esp + 0x1c], cl
mov byte [esp + 0xd], cl
mov al, 0x74
mov dl, 0x65
mov cl, 0x79
push ebx
push ebp
call fcn.00bef610
dec edx
mov byte [esp + 0x23], al
mov bl, 0x53
mov byte [esp + 0x11], dl
mov byte [esp + 0x16], al
mov byte [esp + 0x17], cl
mov byte [esp + 9], cl
mov byte [esp + 0xb], al
mov byte [esp + 0xc], dl
push esi
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push edi
mov byte [esp + 0x18], bl
mov byte [esp + 0x10], bl
mov byte [esp + 0x24], 0x41
mov byte [esp + 0x27], 0x6c
mov byte [esp + 0x29], 0x63
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2d], 0x6f
mov byte [esp + 0x2e], 0x6e
mov byte [esp + 0x2f], 0
mov byte [esp + 0x1a], 0x63
mov byte [esp + 0x1b], 0x75
mov byte [esp + 0x1c], 0x72
mov byte [esp + 0x20], 0
mov byte [esp + 0x12], 0x73
mov byte [esp + 0x15], 0x6d
mov byte [esp + 0x16], 0
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
lea edi, [esp + 0x30]
mov ebx, 3
mov eax, dword [edi]
push eax
push 0
call ebp
mov esi, eax
test esi, esi
je 0x4109e5
push 0
push esi
call fcn.00bef772
and edx, dword [esi - 0x18]
lcall 0xc783, 0x68007df2
add al, 0x4b
add edi, 4
dec ebx
jne 0x4109c8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret

Function at 0x410c40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov al, 0x4e
mov cl, 0x43
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], al
xor al, al
push esi
mov esi, dword [esp + 0x2c]
mov byte [esp + 0x24], al
mov byte [esp + 0x19], al
mov byte [esp + 0x11], al
mov byte [esp + 8], al
lea eax, [esp + 4]
mov byte [esp + 0x1c], cl
mov byte [esp + 0x21], cl
push 4
mov dl, 0x54
mov cl, 0x20
push eax
push esi
mov byte [esp + 0x29], 0x4f
mov byte [esp + 0x2c], 0x45
mov byte [esp + 0x2e], dl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x20], 0x50
mov byte [esp + 0x21], 0x4f
mov byte [esp + 0x22], 0x53
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], cl
mov byte [esp + 0x18], 0x48
mov byte [esp + 0x19], 0x45
mov byte [esp + 0x1a], 0x41
mov byte [esp + 0x1b], 0x44
mov byte [esp + 0x1c], cl
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x11], 0x45
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], cl
call fcn.00477930
add esp, 0xc
test eax, eax
jne 0x410ced
mov ecx, dword [esp + 0x30]
mov eax, 1
pop esi
mov dword [ecx], 4
add esp, 0x24
ret
lea edx, [esp + 0xc]
push 5
push edx
push esi
call fcn.00477930
add esp, 0xc
test eax, eax
jne 0x410d15
mov eax, dword [esp + 0x30]
pop esi
mov dword [eax], 5
mov eax, 2
add esp, 0x24
ret
lea ecx, [esp + 0x14]
push 5
push ecx
push esi
call fcn.00477930
add esp, 0xc
test eax, eax
jne 0x410d3d
mov edx, dword [esp + 0x30]
mov eax, 3
pop esi
mov dword [edx], 5
add esp, 0x24
ret
lea eax, [esp + 0x1c]
push 8
push eax
push esi
call fcn.00477930
add esp, 0xc
test eax, eax
jne 0x410d65
mov ecx, dword [esp + 0x30]
mov eax, 4
pop esi
mov dword [ecx], 8
add esp, 0x24
ret
xor eax, eax
pop esi
add esp, 0x24
ret
Function at 0x415ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x430
push ebx
push ebp
mov ebp, dword [esp + 0x444]
push esi
mov esi, dword [esp + 0x444]
mov ecx, ebp
mov edx, ecx
push edi
xor eax, eax
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dl, 0x53
and ecx, 3
mov byte [esp + 0x18], dl
rep stosb byte es:[edi], al
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x40]
mov byte [esp + 0x1a], dl
rep stosd dword es:[edi], eax
mov al, 0x65
mov cl, 0x72
mov byte [esp + 0x23], al
mov byte [esp + 0x2e], al
mov byte [esp + 0x32], al
mov byte [esp + 0x37], al
mov eax, dword [esp + 0x444]
mov byte [esp + 0x21], cl
mov byte [esp + 0x22], cl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x33], cl
mov byte [esp + 0x2d], dl
mov byte [esp + 0x31], dl
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x44]
mov bl, 0x74
push ecx
push edx
mov byte [esp + 0x25], 0x59
mov byte [esp + 0x27], 0x54
mov byte [esp + 0x28], 0x45
mov byte [esp + 0x29], 0x4d
mov byte [esp + 0x2a], 0x5c
mov byte [esp + 0x2b], 0x43
mov byte [esp + 0x2c], 0x75
mov byte [esp + 0x30], 0x6e
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x43
mov byte [esp + 0x33], 0x6f
mov byte [esp + 0x34], 0x6e
mov byte [esp + 0x35], bl
mov byte [esp + 0x37], 0x6f
mov byte [esp + 0x38], 0x6c
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0x5c
mov byte [esp + 0x40], 0x76
mov byte [esp + 0x41], 0x69
mov byte [esp + 0x42], 0x63
mov byte [esp + 0x44], 0x73
mov byte [esp + 0x45], 0x5c
mov byte [esp + 0x46], 0x25
mov byte [esp + 0x47], 0x73
mov byte [esp + 0x48], 0
call dword [fcn.00480ac8]
push 0
push ebp
push 0
push esi
lea eax, [esp + 0x2c]
push 1
lea ecx, [esp + 0x60]
push eax
mov byte [esp + 0x34], 0x48
mov byte [esp + 0x35], 0x6f
mov byte [esp + 0x36], 0x73
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], 0
push ecx
push 0x80000002
call fcn.004138f0
call fcn.00bf4213
lodsb al, byte [esi]
add esp, 0x2c
push esi
call edi
test eax, eax
jne 0x415e2f
push ebp
push esi
call dword [fcn.00480bcc]
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret

Function at 0x417e20
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dl, byte [esp + 0x2c]
push esi
push 0
push 0
push 0
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
call dword [fcn.00484520]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push 0x417df0
push eax
push ecx
call fcn.0046fb6a
mov edx, dword [esp + 0x28]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push edx
call dword [fcn.0048451c]
mov eax, dword [esp + 0x10]
push eax
call dword [fcn.00484518]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x418180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x42c
push ebx
push ebp
push esi
push edi
xor edi, edi
mov al, 0x6c
push edi
mov byte [esp + 0x18], al
mov byte [esp + 0x19], al
mov byte [esp + 0x29], al
push edi
push edi
lea eax, [esp + 0x1c]
mov esi, 1
mov bl, 0x6f
mov dl, 0x69
mov cl, 0x61
push edi
push eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x44], esi
mov byte [esp + 0x24], 0x4d
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x7a
mov byte [esp + 0x27], dl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], 0x2f
mov byte [esp + 0x2c], 0x34
mov byte [esp + 0x2d], 0x2e
mov byte [esp + 0x2e], 0x30
mov byte cs:[esp + 0x2e], 0x30
mov byte [esp + 0x2f], 0x20
mov byte [esp + 0x30], 0x28
mov byte [esp + 0x31], 0x63
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], 0x6d
mov byte [esp + 0x34], 0x70
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], dl
mov byte [esp + 0x38], 0x62
mov byte [esp + 0x3a], 0x65
mov byte [esp + 0x3b], 0x29
mov byte [esp + 0x3c], 0
call 0xbf5af8
mov ebx, eax
cmp ebx, edi
jne 0x41823b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x42c
ret
mov ecx, dword [esp + 0x440]
push edi
push 0x80000000
push edi
push edi
push ecx
push ebx
call fcn.00bf5c89
loope 0x4181de
call 0xdb77193
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x42c
ret
Function at 0x456f30
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
lea eax, [eax + eax*2]
push ebp
xor ebp, ebp
push esi
lea eax, [eax + eax*4]
push edi
mov dword [esp + 0x10], ebp
lea ecx, [ecx + eax*2 + 0x20]
mov ax, word [edx]
imul ax, word [esp + 0x24]
cmp ax, 0xf800
mov word [ecx], ax
jge 0x456f6a
mov eax, 0xfffff800
jmp 0x456f7a
cmp ax, 0x7ff
jle 0x456f77
mov eax, 0x7ff
jmp 0x456f7a
movsx eax, ax
mov edi, edx
mov word [ecx], ax
lea esi, [edx + 0x10]
lea eax, [ecx + 2]
sub edi, ecx
mov dword [esp + 0x20], esi
mov ecx, 7
mov bx, word [edi + eax]
add esi, 0x10
mov word [eax], bx
mov bx, word [esi - 0x10]
mov word [eax + 0xe], bx
add eax, 2
dec ecx
jne 0x456f90
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov esi, 1
mov ax, word [edi]
sub word [edx], ax
mov eax, dword [esp + 0x1c]
cmp dword [ecx + eax*4 + 0xd4], esi
jne 0x457012
mov ebx, edx
lea esi, [edi + 2]
sub ebx, edi
mov edi, 7
mov cx, word [ebx + esi]
add esi, 2
movsx eax, cx
cdq
xor eax, edx
mov dword [esp + 0x18], ecx
sub cx, word [esi - 2]
sub eax, edx
add ebp, eax
movsx eax, cx
cdq
xor eax, edx
mov word [esi - 2], cx
sub eax, edx
mov edx, dword [esp + 0x10]
add edx, eax
dec edi
mov dword [esp + 0x10], edx
jne 0x456fd4
pop edi
mov eax, ebp
mov ecx, edx
pop esi
pop ebp
sub eax, ecx
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x20]
mov dx, word [ebx]
add ebx, 0x10
mov cx, dx
mov dword [esp + 0x18], edx
movsx eax, cx
sub cx, word [edi + esi*2]
cdq
xor eax, edx
mov word [edi + esi*2], cx
sub eax, edx
add ebp, eax
movsx eax, cx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x10]
add edx, eax
inc esi
cmp esi, 8
mov dword [esp + 0x10], edx
jb 0x457016
pop edi
mov eax, ebp
mov ecx, edx
pop esi
pop ebp
sub eax, ecx
pop ebx
pop ecx
ret
Function at 0xb875a8
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
jmp 0xb875e0
jmp 0xb875c4
lea esp, [esp + 4]
jmp 0xb8758b
jmp 0xb875fc
jmp 0xb87618
push ebx
jmp 0xb87634
jmp 0xb87650
push ebp
jmp 0xb8766c
jmp 0xb87688
push esi
jmp 0xb876a4
jmp 0xbd1710
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0xb90f28]
xor eax, 0x1000000
jmp 0xbd17c9
push edi
movzx edx, byte [eax]
shl edx, 8
movzx esi, byte [eax + 1]
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
jmp 0xbd16d1
mov edi, edx
shr edi, 8
jmp 0xbd1822
and edi, esi
mov edi, dword [edi*4 + 0xb90f28]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0xb90f28]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0xb90f28]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.00bba0ef
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0xb90f28]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0xb90f28]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0xb90f28]
shr edi, 0x18
movzx edi, byte [edi*4 + 0xb90f28]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0xb92750
jne 0xbd187e
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret