joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403ce4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403ce4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0xa
lea edx, [esi + eax]
cmp esi, edx
jae 0x403ce4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x403cc0
cmp esi, edx
jae 0x403ce4
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x40c2a0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ed3b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x248
mov eax, dword [0x442014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x23c], edi
push 0x104
lea eax, [ebp - 0x220]
mov dword [ebp - 0x23c], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
mov dword [ebp - 0x228], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x224], 0
movups xmmword [ebp - 0x238], xmm0
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c330
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x238]
call fcn.00401ee0
mov dword [ebp - 4], 0
mov eax, 0x7ffffffe
mov ecx, dword [ebp - 0x228]
sub eax, ecx
cmp eax, 1
jb 0x40c4aa
cmp dword [ebp - 0x224], 8
lea eax, [ebp - 0x238]
push 1
cmovae eax, dword [ebp - 0x238]
push 0x43c934
push ecx
push eax
push ecx
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x254]
call fcn.0040c670
mov byte [ebp - 4], 1
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x40c3ad
mov esi, dword [esi]
push eax
push esi
lea ecx, [ebp - 0x254]
call fcn.00406d50
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov ecx, dword [ebp - 0x240]
cmp ecx, 8
jb 0x40c431
mov edx, dword [ebp - 0x254]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c427
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c4af
push ecx
push edx
call fcn.00414533
add esp, 8
mov ecx, dword [ebp - 0x224]
xor eax, eax
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
cmp ecx, 8
jb 0x40c48a
mov edx, dword [ebp - 0x238]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c480
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c4af
push ecx
push edx
call fcn.00414533
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004144c6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00402220
call fcn.004192df
int3
Function at 0x40e490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f000
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x442014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x43bdb4
call fcn.004144d4
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004139a4
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4153d7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x415416
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x415416
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415416
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x415416
cmp dword [ecx + 0x74], 0xe
jbe 0x415416
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4232ae
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x434878
push 0x434870
push str.FlsAlloc
push 0x1f
call fcn.00423195
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4232e2
push dword [ebp + 8]
mov ecx, esi
call dword [0x4301a4]
call esi
jmp 0x4232e8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42332c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x434888
push 0x434880
push str.FlsGetValue
push 0x21
call fcn.00423195
mov esi, eax
add esp, 0x10
test esi, esi
je 0x423363
push dword [ebp + 8]
mov ecx, esi
call dword [0x4301a4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42336b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x434890
push 0x434888
push str.FlsSetValue
push 0x22
call fcn.00423195
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4233a5
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4301a4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x425fa4
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x442014]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x425fef
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0042613f
test al, al
jne 0x425fe9
sub edx, 2
cmp edx, edi
jne 0x425fcf
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x426011
lea eax, [edi + 2]
cmp edx, eax
je 0x426011
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00425ef0
add esp, 0x10
jmp 0x42610b
push esi
lea ecx, [ebp - 0x255]
call fcn.0042613f
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x426054
push dword [ebp - 0x25c]
jmp 0x426001
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x426091
cmp word [ebp - 0x226], 0
je 0x4260b2
cmp word [ebp - 0x226], ax
jne 0x426091
cmp word [ebp - 0x224], 0
je 0x4260b2
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00425ef0
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4260fe
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x42606b
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4260e6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x42610b
push 0x425d20
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0042bf50
add esp, 0x10
jmp 0x4260db
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004144c6
leave
ret

Function at 0x428f2f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0041ff49
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x428f9e
cmp esi, dword [ebp - 4]
je 0x428f99
cmp dword [ebp + 0xc], 0
je 0x428f99
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x428f76
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00428a6c
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x428fa0
xor eax, eax
inc eax
jmp 0x428fa0
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x429005
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x442014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0041ff49
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0041ff49
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x42907c
cmp word [ecx], dx
je 0x42907c
mov eax, dword [0x434ea4]
push edi
dec eax
push eax
push 0x434d90
call fcn.00428fa4
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x4290ef
cmp word [eax], dx
je 0x4290ef
mov eax, dword [edi]
test eax, eax
je 0x4290a0
cmp word [eax], dx
je 0x4290a0
lea eax, [ebp - 0x10]
push eax
call fcn.00428972
jmp 0x4290a9
lea eax, [ebp - 0x10]
push eax
call fcn.00428a0d
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x429119
mov eax, dword [0x434d8c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x434a80
call fcn.00428fa4
add esp, 0xc
test al, al
je 0x429119
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x4290e4
cmp word [eax], di
je 0x4290e4
lea eax, [ebp - 0x10]
push eax
call fcn.00428972
pop ecx
jmp 0x42911b
lea eax, [ebp - 0x10]
push eax
call fcn.00428a0d
jmp 0x4290e1
mov eax, dword [edi]
test eax, eax
je 0x429106
cmp word [eax], dx
je 0x429106
lea eax, [ebp - 0x10]
push eax
call fcn.00428927
pop ecx
jmp 0x429119
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x4291e4
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00428e29
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4291e4
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4291e4
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4291e4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x429171
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004234ab
test ebx, ebx
je 0x4291df
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004234ab
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4291e4
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4291e4
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0042c5bd
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4291e6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004144c6
leave
ret
Function at 0x403a70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x290
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x28c], eax
xor eax, eax
push 0x7e
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.00403bf0
xor edx, edx
push 0x1fe
push edx
lea eax, [esp + 0xa2]
push eax
mov word [esp + 0xa4], dx
call fcn.00403bf0
push str.SYSTEMCurrentControlSetServicesUSBSTOREnum
lea ecx, [esp + 0xa8]
push 0x100
push ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 4
call fcn.00403f73
push str.Count
lea edx, [esp + 0x34]
push 0x40
push edx
call fcn.00403f73
add esp, 0x30
lea eax, [esp + 4]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x98]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403b39
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 4]
push eax
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x28c]
mov eax, dword [esp]
xor ecx, esp
call fcn.00403be0
add esp, 0x290
ret

Function at 0x403be0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x403bea
repz ret
jmp fcn.00404193

Function at 0x408a01
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x408a3c
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x408a23
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x408a34
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x408a3e
inc edi
add eax, 0x28
cmp edi, esi
jb 0x408a19
xor eax, eax
pop edi
pop esi
ret
Function at 0x408c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xc]
div ecx
test edx, edx
je 0x408c99
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x30]
mov dword [ebp + 0xc], ecx
push eax
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], 0x6a
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x2c], 0xc3
mov byte [ebp - 0x2b], 0xfc
mov byte [ebp - 0x2a], 0xe7
mov byte [ebp - 0x29], 0xe1
mov byte [ebp - 0x28], pe_nt_image_headers32
mov byte [ebp - 0x27], 0xf4
mov byte [ebp - 0x26], 0xf9
mov byte [ebp - 0x25], 0xd4
mov byte [ebp - 0x24], 0xf9
mov byte [ebp - 0x23], 0xf9
mov byte [ebp - 0x22], 0xfa
mov byte [ebp - 0x21], 0xf6
mov byte [ebp - 0x20], 0x95
call fcn.004089d1
push eax
push edi
push dword [ebp + 8]
call fcn.00408986
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x1a], 0xfb
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], 0x52
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x15], 0x70
mov byte [ebp - 0x14], 0x71
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x68
mov byte [ebp - 0x11], 0x42
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 4
call fcn.004089d1
push eax
push edi
push dword [ebp + 8]
call fcn.00408986
add esp, 0x20
mov dword [ebp - 0xc], eax
call fcn.004089c1
call dword [ebx + 5]
pop esp
xor ecx, dword [ebp + 0x5d889445]
xchg esp, eax

Function at 0x408d57
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebx + 5]
pop esp
xor ecx, dword [ebp + 0x5d889445]
xchg esp, eax
push eax
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xd2
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x7b
mov byte [ebp - 0x67], 0x44
mov byte [ebp - 0x66], 0x5f
mov byte [ebp - 0x65], 0x59
mov byte [ebp - 0x64], 0x58
mov byte [ebp - 0x63], 0x4c
mov byte [ebp - 0x62], 0x41
mov byte [ebp - 0x61], 0x7d
mov byte [ebp - 0x60], 0x5f
mov byte [ebp - 0x5f], 0x42
mov byte [ebp - 0x5e], 0x59
mov byte [ebp - 0x5d], 0x48
mov byte [ebp - 0x5c], 0x4e
mov byte [ebp - 0x5b], 0x59
mov byte [ebp - 0x5a], 0x2d
call fcn.004089d1
push eax
push edi
push dword [ebp + 8]
call fcn.00408986
mov dword [ebp - 0xc4], eax
mov byte [ebp - 0x44], bl
lea eax, [ebp - 0x44]
mov byte [ebp - 0x43], bl
push eax
mov byte [ebp - 0x42], 0xfd
invalid
Function at 0x408fe2
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [edi + 4], ebx
jne 0x408f80
cmp dword [edi + 0xc], ebx
je 0x40902a
mov esi, dword [edi + 0xc]
add esi, dword [ebp + 0xc]
push esi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x408fa6
push esi
call dword [ebp - 0xc8]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x4091cc
add al, ch
push ss
cli
invalid
call fcn.004089c1
retf
mov ecx, dword [ebp + 0xc]
add ecx, eax
test eax, 0x80000000
je 0x408fe7
and eax, 0xffff
push eax
jmp 0x408feb
add ecx, 2
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00408986
add esp, 0xc
cmp esi, ebx
mov dword [esi], eax
je 0x4091cc
add dword [ebp + 0x10], 4
add esi, 4
call fcn.004089c1
push ss
jne 0x408fa5
insd dword es:[edi], dx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
jne 0x408fd3
mov esi, dword [ebp - 0x88]
add edi, 0x14
jmp 0x408f72
mov eax, dword [esi + 0xa0]
cmp eax, ebx
je 0x409080
add eax, dword [ebp + 0xc]
cmp dword [eax], ebx
je 0x409080
lea edi, [eax + 8]
mov ecx, dword [eax + 4]
add ecx, eax
cmp edi, ecx
jae 0x40907b
movzx ecx, word [edi]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40906f
mov edx, dword [ebp + 0xc]
and ecx, 0xfff
add ecx, dword [ebp + 0xc]
sub edx, dword [esi + 0x34]
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x409077
cmp edx, ebx
jne 0x4091cc
inc edi
inc edi
jmp 0x40903e
add eax, dword [eax + 4]
jmp 0x409037
mov dword [ebp - 8], ebx
jmp 0x40908b

Function at 0x409003
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [edi + 4], ebx
jne 0x408f80
cmp dword [edi + 0xc], ebx
je 0x40902a
mov esi, dword [edi + 0xc]
add esi, dword [ebp + 0xc]
push esi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x408fa6
push esi
call dword [ebp - 0xc8]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x4091cc
add al, ch
push ss
cli
invalid
call fcn.004089c1
retf
mov ecx, dword [ebp + 0xc]
add ecx, eax
test eax, 0x80000000
je 0x408fe7
and eax, 0xffff
push eax
jmp 0x408feb
add ecx, 2
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00408986
add esp, 0xc
cmp esi, ebx
mov dword [esi], eax
je 0x4091cc
add dword [ebp + 0x10], 4
add esi, 4
call fcn.004089c1
push ss
jne 0x408fa5
insd dword es:[edi], dx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
jne 0x408fd3
mov esi, dword [ebp - 0x88]
add edi, 0x14
jmp 0x408f72
mov eax, dword [esi + 0xa0]
cmp eax, ebx
je 0x409080
add eax, dword [ebp + 0xc]
cmp dword [eax], ebx
je 0x409080
lea edi, [eax + 8]
mov ecx, dword [eax + 4]
add ecx, eax
cmp edi, ecx
jae 0x40907b
movzx ecx, word [edi]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40906f
mov edx, dword [ebp + 0xc]
and ecx, 0xfff
add ecx, dword [ebp + 0xc]
sub edx, dword [esi + 0x34]
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x409077
cmp edx, ebx
jne 0x4091cc
inc edi
inc edi
jmp 0x40903e
add eax, dword [eax + 4]
jmp 0x409037
mov dword [ebp - 8], ebx
jmp 0x40908b
Function at 0x409100
Capabilities:
Inspect section memory permissions

Disassembly:
mov esi, dword [ebp - 0x88]
mov ax, word [ebp - 8]
cmp ax, word [esi + 6]
jne 0x4090a4
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov esi, 0x60000000
jmp 0x4090cc
call fcn.004089c1
xor eax, 0xf0df433
mov bh, 0x45
clc
lea eax, [eax + eax*4]
mov ecx, dword [esi + eax*8 + 0x104]
mov edx, dword [esi + eax*8 + 0x108]
lea eax, [esi + eax*8 + 0xf8]
mov esi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp + 8], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp + 8]
ja 0x409122
mov edx, esi
mov edi, esi
and edx, 0x20000000
and edi, 0x40000000
and esi, 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40910b
or byte [eax + ecx], 1
cmp edi, ebx
je 0x409113
or byte [eax + ecx], 2
cmp esi, ebx
je 0x40911c
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp + 8]
jbe fcn.00409100
inc dword [ebp - 8]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp - 8]
cmp cx, word [eax + 6]
jbe 0x409085
mov esi, dword [ebp + 0xc]
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40916f
dec eax
je 0x409166
sub eax, 3
je 0x40915d
mov dword [ebp - 4], 0x40
jmp 0x409172
mov dword [ebp - 4], 4
jmp 0x409172
mov dword [ebp - 4], 0x20
jmp 0x409172
mov dword [ebp - 4], ecx
call fcn.004089c1
dec esp
out 5, al
cmp dword [ebx + 0x7440fc7d], eax
sbb byte [ebp - 0xaf03bb], cl
jne 0x409184
push eax
push dword [ebp - 4]
invalid
mov ch, 0x54
Function at 0x40a6c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x40a73c
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0x50
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0xf3
push ebx
mov byte [ebp - 0x7a7], 0xe8
mov byte [ebp - 0x7a6], 0xeb
mov byte [ebp - 0x7a5], 0xc3
mov byte [ebp - 0x7a4], 0x9c
mov byte [ebp - 0x7a3], 0x9d
mov byte [ebp - 0x7a2], 0x81
mov byte [ebp - 0x7a1], 0xcb
mov byte [ebp - 0x7a0], 0xc3
mov byte [ebp - 0x79f], 0xc3
mov byte [ebp - 0x79e], 0xaf
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.004089d1
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00408932
add esp, 0xc
jmp 0x40a933
cmp dword [ebp - 0x6fc], 4
jne 0x40a7dd
and byte [ebp - 0x7bc], 0
and byte [ebp - 0x7bb], 0
mov byte [ebp - 0x7ba], 0x41
and byte [ebp - 0x7b9], 0
mov byte [ebp - 0x7b8], 0xe2
mov byte [ebp - 0x7b7], 0xf1
mov byte [ebp - 0x7b6], 0xf2
mov byte [ebp - 0x7b5], 0xfb
mov byte [ebp - 0x7b4], 0x8c
mov byte [ebp - 0x7b3], 0x8d
mov byte [ebp - 0x7b2], 0x90
mov byte [ebp - 0x7b1], 0xda
mov byte [ebp - 0x7b0], 0xd2
mov byte [ebp - 0x7af], 0xd2
mov byte [ebp - 0x7ae], 0xbe
push 0xb
lea eax, [ebp - 0x7bc]
push eax
call fcn.004089d1
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00408932
add esp, 0xc
jmp 0x40a933
cmp dword [ebp - 0x6fc], 5
jne 0x40a887
and byte [ebp - 0x7cc], 0
and byte [ebp - 0x7cb], 0
mov byte [ebp - 0x7ca], 0x8a
and byte [ebp - 0x7c9], 0
mov byte [ebp - 0x7c8], 0x29
mov byte [ebp - 0x7c7], 0x25
mov byte [ebp - 0x7c6], 0x26
mov byte [ebp - 0x7c5], 0x34
mov byte [ebp - 0x7c4], 0x25
mov byte [ebp - 0x7c3], 0x19
call [ecx]
mov byte [ebp - 0x7c2], 0x5b
mov byte [ebp - 0x7c1], 0x11
mov byte [ebp - 0x7c0], 0x19
mov byte [ebp - 0x7bf], 0x19
mov byte [ebp - 0x7be], 0x75
call fcn.004089c1
cld
popfd
jne 0x40a8c7
or ecx, dword [ebp - 0x7cb7b]
call dword [eax - 0x18]
loope 0x40a868
invalid
call [ecx + 0x50]
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00408932
add esp, 0xc
jmp 0x40a933
cmp dword [ebp - 0x6fc], 6
jne 0x40a92e
and byte [ebp - 0x7dc], 0
and byte [ebp - 0x7db], 0
mov byte [ebp - 0x7da], 0xd4
and byte [ebp - 0x7d9], 0
mov byte [ebp - 0x7d8], 0x77
mov byte [ebp - 0x7d7], 0x4e
mov byte [ebp - 0x7d6], 0x59
mov byte [ebp - 0x7d5], 0x59
mov byte [ebp - 0x7d4], 0x44
mov byte [ebp - 0x7d3], 0x59
mov byte [ebp - 0x7d2], 5
mov byte [ebp - 0x7d1], 0x47
mov byte [ebp - 0x7d0], 0x44
mov byte [ebp - 0x7cf], 0x4c
mov byte [ebp - 0x7ce], 0x2b
call fcn.004089c1
popfd
das
aad 0xb7
push 0xb
lea eax, [ebp - 0x7dc]
push eax
call fcn.004089d1
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00408932
add esp, 0xc
jmp 0x40a933
sub edi, eax
invalid
jmp 0x40aa61