joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010c390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
mov eax, dword [0x1017cf40]
xor eax, esp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0xa4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xa8]
push edi
push eax
push dword [ecx + 0x14]
mov edi, edx
mov dword [esp + 0x2c], eax
mov edx, dword [ecx + 0x10]
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
call fcn.1010e6b0
add esp, 8
test eax, eax
jne 0x1010c526
mov eax, dword [esp + 0xb0]
mov ebp, dword [esp + 0xa8]
mov ebx, dword [esp + 0xa4]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x74], 1
mov dword [esp + 0x70], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x78], 1
nop
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x40000
test ebp, ebp
ja 0x1010c462
jb 0x1010c45e
cmp ebx, 0x40000
jae 0x1010c462
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [edi]
push edi
call eax
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1010c513
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x28]
mov edx, dword [esp + 0xb0]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
push eax
push 1
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
call fcn.1010e3d0
mov esi, eax
add esp, 0x10
mov eax, dword [esp + 0x18]
sub dword [esp + 0x10], eax
sub ebx, eax
sbb ebp, 0
test esi, esi
jne 0x1010c513
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
cmp ecx, edx
je 0x1010c4f0
test eax, eax
jne 0x1010c4da
cmp dword [esp + 0x1c], ecx
je 0x1010c4f0
push eax
mov eax, dword [edi + 4]
push edi
call eax
mov esi, eax
add esp, 8
test esi, esi
je 0x1010c440
jmp 0x1010c513
cmp edx, dword [esp + 0xb0]
jne 0x1010c50e
cmp dword [esp + 0x10], 0
jne 0x1010c50e
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x1010c513
cmp eax, 4
je 0x1010c513
mov esi, 1
mov eax, dword [esp + 0x24]
push dword [esp + 0x38]
push eax
mov eax, dword [eax + 4]
call eax
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010f1c0
add esp, 0x90
ret
Function at 0x1010eb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebp
push edi
mov ebp, ecx
xor edi, edi
mov eax, dword [eax]
and eax, 7
mov dword [esp + 0x10], ebp
cmp edx, 5
jae 0x1010eba3
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret
push ebx
add edx, 0xfffffffc
or ebx, 0xffffffff
add edx, ebp
push esi
mov dword [esp + 0x10], edx
lea esi, [edi + ebp]
cmp esi, edx
jae 0x1010ebc7
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x1010ebc7
inc esi
cmp esi, edx
jb 0x1010ebb8
mov edi, esi
sub edi, ebp
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x1010ecd4
cmp ecx, 3
jbe 0x1010ec05
xor eax, eax
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [esp + 0x14], ebx
test cl, cl
je 0x1010ec41
cmp cl, 0xff
je 0x1010ec41
mov edx, dword [esp + 0x10]
and eax, 3
add eax, eax
mov ecx, 1
or eax, 1
add edi, ecx
jmp 0x1010ebb1
dec ecx
shl eax, cl
and eax, 7
je 0x1010ebde
movzx ecx, byte [eax + 0x1016e830]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x1016e828], 0
mov cl, byte [edx + 4]
je 0x1010ec2d
test cl, cl
je 0x1010ec2d
cmp cl, 0xff
jne 0x1010ebde
mov edx, dword [esp + 0x10]
and eax, 3
add eax, eax
mov ebx, edi
or eax, 1
inc edi
jmp 0x1010ebb1
movzx edx, cl
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
nop
sub edx, edi
lea ebx, [edx - 5]
test eax, eax
je 0x1010ec9a
movzx ebp, byte [eax + 0x1016e830]
mov ecx, 0x18
shl ebp, 3
mov edx, ebx
sub ecx, ebp
shr edx, cl
test dl, dl
je 0x1010ec87
cmp dl, 0xff
jne 0x1010ec9a
mov ecx, 0x20
mov edx, 1
sub ecx, ebp
shl edx, cl
dec edx
xor edx, ebx
jmp 0x1010ec60
mov ebp, dword [esp + 0x18]
mov ecx, ebx
mov edx, dword [esp + 0x10]
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [esp + 0x14]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
add edi, ecx
jmp 0x1010ebb1
pop esi
pop ebx
cmp ecx, 3
jbe 0x1010eceb
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
pop ebp
add esp, 0xc
ret
dec ecx
shl eax, cl
mov ecx, dword [esp + 0x1c]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
pop ebp
add esp, 0xc
ret

Function at 0x1012ab2c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1012a9ab

Function at 0x1012f9f3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1012f6b3
Function at 0x40593b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004032d6
and dword [ebp - 0x14], 0
cmp dword [0x40b7d8], 0
mov dword [ebp - 0x18], eax
jne 0x4059ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405a96
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405a96
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40b7d8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40b7dc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40b7e0], eax
call edi
push eax
call esi
mov dword [0x40b7e8], eax
test eax, eax
je 0x4059ee
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40b7e4], eax
mov eax, dword [0x40b7e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405a47
cmp dword [0x40b7e8], ecx
je 0x405a47
push eax
call esi
push dword [0x40b7e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405a47
test ebx, ebx
je 0x405a47
call edi
test eax, eax
je 0x405a3e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405a3e
test byte [ebp - 8], 1
jne 0x405a47
or dword [ebp + 0x10], 0x200000
jmp 0x405a7a
mov eax, dword [0x40b7dc]
cmp eax, dword [ebp - 0x18]
je 0x405a7a
push eax
call esi
test eax, eax
je 0x405a7a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405a7a
mov eax, dword [0x40b7e0]
cmp eax, dword [ebp - 0x18]
je 0x405a7a
push eax
call esi
test eax, eax
je 0x405a7a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b7d8]
call esi
test eax, eax
je 0x405a96
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405a98
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040269a
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403810
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f566
mov eax, dword fs:[0]
push eax
sub esp, 0x8ac
mov eax, dword [0x454710]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.004226a0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x424], ax
push 0x206
push eax
lea eax, [ebp - 0x422]
push eax
call fcn.004226a0
add esp, 0xc
mov byte [ebp - 0x82c], 0
lea eax, [ebp - 0x82b]
push 0x400
push 0
push eax
call fcn.004226a0
add esp, 0xc
lea eax, [ebp - 0x8b4]
push 0x70
push 0
push eax
call fcn.004226a0
add esp, 0xc
lea ecx, [ebp - 0x8b4]
call fcn.00404b90
mov dword [ebp - 4], 0
mov dword [ebp - 0x830], 0xf
mov dword [ebp - 0x834], 0
mov byte [ebp - 0x844], 0
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 1
push eax
push 0
push 0
push 0x1a
push 0
mov dword [ebp - 0x8b8], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40392a
cmp dword [esi + 0x18], 8
lea eax, [esi + 4]
jb 0x40390d
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push str._sHNCUserHwpConfig_s.json
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x44c408
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x8b8]
push eax
call fcn.00421483
mov eax, dword [ebp - 0x8b8]
add esp, 0xc
test eax, eax
je 0x403a16
push eax
push 0x400
lea eax, [ebp - 0x82c]
push 1
push eax
call fcn.00421757
add esp, 0x10
test eax, eax
je 0x4039c2
mov edi, edi
cmp byte [ebp - 0x82c], 0
jne 0x40397d
xor eax, eax
jmp 0x40398f
lea eax, [ebp - 0x82c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403986
sub eax, edx
push eax
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x844]
call fcn.00402640
push dword [ebp - 0x8b8]
lea eax, [ebp - 0x82c]
push 0x400
push 1
push eax
call fcn.00421757
add esp, 0x10
test eax, eax
jne 0x403970
push dword [ebp - 0x8b8]
call fcn.0042186f
add esp, 4
lea eax, [ebp - 0x844]
lea ecx, [ebp - 0x88c]
push 0xffffffffffffffff
push 0
push eax
call fcn.00403020
cmp dword [ebp - 0x878], 0x10
lea ecx, [ebp - 0x88c]
mov eax, dword [ebp - 0x87c]
cmovae ecx, dword [ebp - 0x88c]
push ecx
push edi
add eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x8b4]
call fcn.00404ca0
movzx esi, al
jmp 0x403a18
xor esi, esi
cmp dword [ebp - 0x830], 0x10
jb 0x403a2f
push dword [ebp - 0x844]
call fcn.0040ea18
add esp, 4
lea ecx, [ebp - 0x8b4]
mov dword [ebp - 0x830], 0xf
mov dword [ebp - 0x834], 0
mov byte [ebp - 0x844], 0
call fcn.00403a80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004208e3
mov esp, ebp
pop ebp
ret 4
Function at 0x40e070
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4400e1
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x454710]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x240], 7
mov dword [ebp - 0x244], 0
mov word [ebp - 0x254], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 7
mov dword [ebp - 0x25c], eax
mov word [ebp - 0x26c], ax
push 1
push 0x44cad0
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 1
call fcn.00404310
cmp word [esi], 0
jne 0x40e10a
xor ecx, ecx
jmp 0x40e11f
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e110
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x254]
call fcn.0040e3d0
cmp dword [ebp - 0x240], 8
lea ecx, [ebp - 0x270]
push ecx
push 0xf003f
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e27f
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.004226a0
add esp, 0xc
mov dword [ebp - 0x220], 0x104
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x21c], 0
je 0x40e27f
xor eax, eax
mov dword [ebp - 0x228], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x23c], ax
lea ecx, [ebp - 0x23c]
lea eax, [ebp - 0x254]
mov dword [ebp - 0x22c], 0
push eax
call fcn.00404510
push 1
push 0x44c54c
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 2
call fcn.0040e3d0
cmp word [ebp - 0x21c], 0
jne 0x40e21d
xor ecx, ecx
jmp 0x40e235
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e226
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x23c]
call fcn.0040e3d0
cmp dword [ebp - 0x228], 8
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
cmp dword [ebp - 0x228], 8
jb 0x40e27f
push dword [ebp - 0x23c]
call fcn.0040ea18
add esp, 4
cmp dword [ebp - 0x240], 8
jb 0x40e296
push dword [ebp - 0x254]
call fcn.0040ea18
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004208e3
mov esp, ebp
pop ebp
ret 4
Function at 0x427006
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb bh, bh
jne 0x42701e
call fcn.00426723
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0042676e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00426723
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0042676e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00426723
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.0042675e
inc ecx
insb byte es:[edi], dx
jp 0x4271fb
and byte [ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
test edx, edx
cli
invalid
Function at 0x427326
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lcall 0xffff, 0xfae485c6
lodsb al, byte [esi]
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.0042676e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00426723
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.0042675e
enter 0xffffffffffffcec8, 0xffffffffffffffa0
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.0042676e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00426723
add esp, 0xc
mov dword [ebp - 0x33c], eax
invalid
push edx
invalid
invalid

Function at 0x428468
Capabilities:
Contain obfuscated stackstrings

Disassembly:
in eax, dx
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.0042676e
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.004266cf
add esp, 0xc
jmp 0x4286d6
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0xbd64a04
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x78214ab0
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x531c7b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x531d00
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0050cdc0
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x531cc3
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x531ce5
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x531d5b
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.005319cb
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x531d47
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x531d5b
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x531c84
pop esi
pop ebx
leave
ret

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
sub bl, dh
xchg dword [esi + 0x78], edx
lcall 0x400a, 0x7b7dd103
outsd dx, dword [esi]
cmp dword [edx - 6], esp
mov edx, dword [edx - 0x7a7cd3c8]
xor bh, byte [eax - 7]
invalid
Function at 0x456f00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3d000]
push edi
jmp 0x456f1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x456f21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x456f10
mov eax, 1
add ebx, ebx
jne 0x456f33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x456f44
jne 0x456f63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x456f63
dec eax
add ebx, ebx
jne 0x456f50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x456f28
add ebx, ebx
jne 0x456f5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x456fb5
xor ecx, ecx
sub eax, 3
jb 0x456f7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x456fea
sar eax, 1
mov ebp, eax
jmp 0x456f86
add ebx, ebx
jne 0x456f86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x456f54
inc ecx
add ebx, ebx
jne 0x456f94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x456f54
add ebx, ebx
jne 0x456fa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x456f96
jne 0x456fb2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x456f96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x456fd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x456fc6
jmp 0x456f16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x456fd4
add edi, ecx
jmp 0x456f16
pop esi
mov edi, esi
mov ecx, 0x172f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x456ff2
cmp byte [edi], 7
jne 0x456ff2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x456ff7
lea edi, [esi + 0x54000]
mov eax, dword [edi]
or eax, eax
je 0x45706f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x583b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x583f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x457024
mov ecx, edi
jns 0x457053
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x583fc]
or eax, eax
je 0x457069
mov dword [ebx], eax
add ebx, 4
jmp 0x457041
call dword [esi + 0x583f8]
mov ebp, dword [esi + 0x58400]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4570a3
sub esp, 0xffffff80
jmp 0x403b14
Function at 0x401550
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x448044]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004279d0
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jne 0x4015b5
cmp dword [ebp - 0x118], 0
jne 0x4015b5
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret

Function at 0x4015d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x448044]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004279d0
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret

Function at 0x401630
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x448044]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004279d0
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x11c]
cmp eax, 5
jbe 0x4016a5
cmp eax, 6
jbe 0x401693
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
jne 0x4016a5
mov eax, dword [ebp - 0x118]
cmp eax, 1
jbe 0x4016a5
cmp eax, 2
jae 0x401680
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret