joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422cf8
Capabilities:
Get number of processors

Disassembly:
and edx, 0x14209
sub edx, 0x42af
or edx, 0x181e1
pop edx
lea edx, [ebp - 0xc50]
mov dword [ebp - 0x6ac], edx
mov eax, dword [ebp - 0x25c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x6a8], ecx
xor edx, edx
mov word [ebp - 0x114], dx
xor eax, eax
mov word [ebp - 0x28], ax
push ecx
push esi
add esp, 4
sub ecx, 0xfed0
and ecx, 0x4e22
or ecx, 0x5826
jmp 0x422bbc
pop ecx
push ecx
push esi
add esp, 4
and ecx, 0xfa32
or ecx, 0x13ecd
pop ecx
mov ecx, dword [ebp - 0x6a8]
mov dx, word [ecx]
mov word [ebp - 0x87a], dx
mov eax, dword [ebp - 0x6a8]
add eax, 2
mov dword [ebp - 0x6a8], eax
mov cx, word [ebp - 0x87a]
mov word [ebp - 0x114], cx
mov edx, dword [ebp - 0x6ac]
mov ax, word [edx]
mov word [ebp - 0x92c], ax
mov ecx, dword [ebp - 0x6ac]
add ecx, 2
mov dword [ebp - 0x6ac], ecx
mov dx, word [ebp - 0x92c]
mov word [ebp - 0x28], dx
push edi
push ebx
add esp, 4
sub edi, 0x17fc8
pop edi
push eax
push ecx
add esp, 4
or eax, 0x921f
jmp 0x422c45
xor eax, 0x15f2f
pop eax
push edx
push esi
add esp, 4
and edx, 0xaf9f
pop edx
movzx eax, word [ebp - 0x28]
test eax, eax
jne 0x422c75
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0xb5c], ecx
jmp 0x422ccf
movzx eax, word [ebp - 0x114]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x422b9d
movzx edx, word [ebp - 0x114]
xor edx, 0x20
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x422b9d
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
jge 0x422cb9
mov dword [ebp - 0xb58], 0xffffffff
jmp 0x422cc3
mov dword [ebp - 0xb58], 1
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xb5c], 0
jne 0x422d18
push edx
call 0x422ce7
add byte [ebp + 0x4e], cl
inc esp
cmp al, 0x46
cmp al, 0x36
add esp, 4
call 0x422cf8
add byte [eax + 0x3f], dl
inc ebp
dec edx
dec ebp
inc edx
inc ecx
xor eax, dword [ebx + 0x575a04c4]
xor edi, 0xc1d2
sub edi, 0x3149
pop edi
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x188], ecx
jmp 0x422d80
push eax
xor eax, 0x5ab7
sub eax, 0xf3e4
and eax, 0x1253d
add eax, 0xcf43
pop eax
push edx
call 0x422d40
add byte [edx], bh
inc ebx
xor al, 0x4d
inc eax
add esp, 4
sub edx, 0x24f9
pop edx
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [ebp - 0x6b0]
je 0x422d76
mov edx, dword [ebp - 0x25c]
cmp dword [edx + 0x30], 0
jne 0x422b41
mov dword [ebp - 0x188], 0
Function at 0x422d40
Capabilities:
Get number of processors

Disassembly:
and edx, 0x14209
sub edx, 0x42af
or edx, 0x181e1
pop edx
lea edx, [ebp - 0xc50]
mov dword [ebp - 0x6ac], edx
mov eax, dword [ebp - 0x25c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x6a8], ecx
xor edx, edx
mov word [ebp - 0x114], dx
xor eax, eax
mov word [ebp - 0x28], ax
push ecx
push esi
add esp, 4
sub ecx, 0xfed0
and ecx, 0x4e22
or ecx, 0x5826
jmp 0x422bbc
pop ecx
push ecx
push esi
add esp, 4
and ecx, 0xfa32
or ecx, 0x13ecd
pop ecx
mov ecx, dword [ebp - 0x6a8]
mov dx, word [ecx]
mov word [ebp - 0x87a], dx
mov eax, dword [ebp - 0x6a8]
add eax, 2
mov dword [ebp - 0x6a8], eax
mov cx, word [ebp - 0x87a]
mov word [ebp - 0x114], cx
mov edx, dword [ebp - 0x6ac]
mov ax, word [edx]
mov word [ebp - 0x92c], ax
mov ecx, dword [ebp - 0x6ac]
add ecx, 2
mov dword [ebp - 0x6ac], ecx
mov dx, word [ebp - 0x92c]
mov word [ebp - 0x28], dx
push edi
push ebx
add esp, 4
sub edi, 0x17fc8
pop edi
push eax
push ecx
add esp, 4
or eax, 0x921f
jmp 0x422c45
xor eax, 0x15f2f
pop eax
push edx
push esi
add esp, 4
and edx, 0xaf9f
pop edx
movzx eax, word [ebp - 0x28]
test eax, eax
jne 0x422c75
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0xb5c], ecx
jmp 0x422ccf
movzx eax, word [ebp - 0x114]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x422b9d
movzx edx, word [ebp - 0x114]
xor edx, 0x20
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x422b9d
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
jge 0x422cb9
mov dword [ebp - 0xb58], 0xffffffff
jmp 0x422cc3
mov dword [ebp - 0xb58], 1
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xb5c], 0
jne 0x422d18
push edx
call 0x422ce7
add byte [ebp + 0x4e], cl
inc esp
cmp al, 0x46
cmp al, 0x36
add esp, 4
call 0x422cf8
add byte [eax + 0x3f], dl
inc ebp
dec edx
dec ebp
inc edx
inc ecx
xor eax, dword [ebx + 0x575a04c4]
xor edi, 0xc1d2
sub edi, 0x3149
pop edi
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x188], ecx
jmp 0x422d80
push eax
xor eax, 0x5ab7
sub eax, 0xf3e4
and eax, 0x1253d
add eax, 0xcf43
pop eax
push edx
call 0x422d40
add byte [edx], bh
inc ebx
xor al, 0x4d
inc eax
add esp, 4
sub edx, 0x24f9
pop edx
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [ebp - 0x6b0]
je 0x422d76
mov edx, dword [ebp - 0x25c]
cmp dword [edx + 0x30], 0
jne 0x422b41
mov dword [ebp - 0x188], 0
Function at 0x423c83
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x3e4]
add eax, 1
mov dword [ebp - 0x3e4], eax
mov ecx, dword [ebp - 0x3e0]
mov edx, dword [ebp - 0x3e4]
cmp edx, dword [ecx + 0x18]
jae 0x423d58
mov eax, dword [ebp - 0x3e4]
mov ecx, dword [ebp - 0xe58]
mov edx, dword [ebp - 0x1b8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x3e8], edx
mov eax, dword [ebp - 0x3e4]
mov ecx, dword [ebp - 0xe5c]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0xe60]
mov ecx, dword [ebp - 0x1b8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0xe64], ecx
mov dword [ebp - 0xc8], 0
jmp 0x423bbc
mov edx, dword [ebp - 0xc8]
add edx, 1
mov dword [ebp - 0xc8], edx
mov eax, dword [ebp - 0x3e8]
add eax, dword [ebp - 0xc8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x423c6e
mov edx, dword [ebp - 0xc8]
movsx eax, byte [ebp + edx - 0x494]
test eax, eax
je 0x423c6e
push esi
add esi, 0x6510
xor esi, 0x15f3d
add esi, 0x7ce4
pop esi
push eax
push eax
add esp, 4
sub eax, 0xfc2c
xor eax, 0x402f
pop eax
push eax
push eax
add esp, 4
add eax, 0xc84e
pop eax
mov ecx, dword [ebp - 0x3e8]
add ecx, dword [ebp - 0xc8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0xc8]
movsx ecx, byte [ebp + eax - 0x494]
cmp edx, ecx
je 0x423c60
mov edx, dword [ebp - 0x3e8]
add edx, dword [ebp - 0xc8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0xc8]
movsx edx, byte [ebp + ecx - 0x494]
cmp eax, edx
jne 0x423c67
jmp 0x423bad
jmp 0x423c6e
push edx
push esi
add esp, 4
call fcn.00423c83
add byte [esi + edi + 0x4b], cl
xor al, 0x4e
inc edx
inc eax
cmp al, 0x4e
add esp, 4
or edx, 0x43d2
jmp 0x423c94
pop edx
push esi
jmp 0x423c9f
pop esi
mov eax, dword [ebp - 0x3e8]
add eax, dword [ebp - 0xc8]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0xc8]
movsx eax, byte [ebp + edx - 0x494]
cmp ecx, eax
jne 0x423ccd
mov dword [ebp - 0x6d0], 0
jmp 0x423d3c
push edx
push ecx
add esp, 4
and edx, 0x2d45
sub edx, 0x14d3d
pop edx
push esi
add esi, 0x1567d
pop esi
push ebx
push ecx
add esp, 4
sub ebx, 0x8cf0
and ebx, 0x6359
and ebx, 0x10dfc
pop ebx
mov ecx, dword [ebp - 0x3e8]
add ecx, dword [ebp - 0xc8]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0xc8]
movsx ecx, byte [ebp + eax - 0x494]
or ecx, 0x20
cmp edx, ecx
jge 0x423d32
mov dword [ebp - 0x6d0], 0xffffffff
jmp 0x423d3c
mov dword [ebp - 0x6d0], 1
cmp dword [ebp - 0x6d0], 0
jne 0x423d53
mov edx, dword [ebp - 0xe64]
mov dword [ebp - 0x250], edx
jmp 0x423d64
jmp 0x423b3d
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x250], eax
mov ecx, dword [ebp - 0x250]
mov dword [ebp - 0x418], ecx
Function at 0x424a05
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esi, 0x17ec5
pop esi
push ebx
call 0x424a05
add byte [edx], bh
inc ebx
xor edi, dword [0x834c3c36]
les eax, [ecx + eax*4]
ret
Function at 0x5bd580
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10f000]
push edi
jmp 0x5bd59a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5bd5a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5bd590
mov eax, 1
add ebx, ebx
jne 0x5bd5b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5bd5c4
jne 0x5bd5e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5bd5e3
dec eax
add ebx, ebx
jne 0x5bd5d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5bd5a8
add ebx, ebx
jne 0x5bd5df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5bd635
xor ecx, ecx
sub eax, 3
jb 0x5bd5fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5bd66a
sar eax, 1
mov ebp, eax
jmp 0x5bd606
add ebx, ebx
jne 0x5bd606
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5bd5d4
inc ecx
add ebx, ebx
jne 0x5bd614
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5bd5d4
add ebx, ebx
jne 0x5bd621
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5bd616
jne 0x5bd632
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5bd616
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5bd654
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5bd646
jmp 0x5bd596
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5bd654
add edi, ecx
jmp 0x5bd596
pop esi
lea edi, [esi + 0x124000]
mov ecx, 0x292
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5bd676
cmp byte [edi], 0x16
jne 0x5bd676
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5bd67b
lea edi, [esi + 0x1ba000]
mov eax, dword [edi]
or eax, eax
je 0x5bd6ea
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1bf400]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1bf510]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5bd6a8
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1bf518]
or eax, eax
je 0x5bd6e4
mov dword [ebx], eax
add ebx, 4
jmp 0x5bd6c5
call dword [esi + 0x1bf514]
mov ebp, dword [esi + 0x1bf51c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x187]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5bd71e
sub esp, 0xffffff80
jmp 0x40331f
Function at 0x29a078a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x29a078b6
pop dword [ebp - 0x48]
mov eax, 0x29a078b6
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xcc65a586
sub dword [ebp - 0x58], 0x7e13603b
mov dword [ebp - 0x54], 0x506bbd56
sub dword [ebp - 0x54], 0x1e387111
mov dword [ebp - 0x50], 0xe7db28ac
sub dword [ebp - 0x50], 0x9b8ee47e
mov dword [ebp - 0x4c], 0x7eb2ff8a
add dword [ebp - 0x4c], 0x814d0076
lea eax, [ebp - 0x58]
push eax
mov eax, 0xebfa1321
add eax, 0x3da72d6b
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xa96287ac
add dword [ebp - 0x58], 0xcb0fe1aa
mov dword [ebp - 0x54], 0x6661ee54
add dword [ebp - 0x54], 0xdb0a7321
mov dword [ebp - 0x50], 0x633bf6fb
sub dword [ebp - 0x50], 0xffcc8a8f
mov dword [ebp - 0x4c], 0x8f1ef1c4
sub dword [ebp - 0x4c], 0x8f1ef1c4
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xdc74d46d
sub eax, 0xb2d39429
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x39d4b
push 0
call eax
mov ecx, 0xc3cf8b04
sub ecx, 0xc3cf44c1
xor edx, edx
add edx, eax
mov edi, 0x29a22000
add edi, dword [ebp - 0x48]
mov esi, 0x9be5e086
add esi, 0x14dac082
xor dword [ebp - 0x34], esi
mov ebx, dword [edi]
sub dword [ebp - 4], ecx
sub ebx, esi
add dword [ebp - 0x18], ecx
mov dword [edx], ebx
add dword [ebp - 0x44], 0x359c1a21
add edx, 4
add edi, 4
loop 0x29a079cf
add eax, 0x10bdf
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x29a00000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x402568
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402576
call dword [0x40b004]
or eax, eax
je 0x402577
ret
mov al, 1
jmp fcn.004025e8

Function at 0x402580
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40258e
call dword [0x40b008]
or eax, eax
jne 0x40258f
ret
mov al, 2
jmp fcn.004025e8

Function at 0x402598
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4025d0
test edx, edx
je 0x4025ba
push eax
mov eax, ecx
call dword [0x40b00c]
pop ecx
or eax, eax
je 0x4025c9
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.004025e8
mov dword [eax], edx
mov eax, ecx
call dword [0x40b008]
or eax, eax
jne 0x4025b3
ret
mov al, 1
jmp fcn.004025e8
test edx, edx
je 0x4025e4
push eax
mov eax, edx
call dword [0x40b004]
pop ecx
or eax, eax
je 0x4025c9
mov dword [ecx], eax
ret

Function at 0x403754
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.004025e8
cmp eax, edx
je 0x4037c4
cmp word [eax], 8
jb 0x403779
push eax
push edx
cmp word [eax], 0x100
je 0x40376f
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x403777
add eax, 8
call fcn.0040316c
pop edx
pop eax
cmp word [edx], 8
jae 0x403790
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
jne 0x4037b0
mov edx, dword [edx + 8]
or edx, edx
je 0x4037a7
mov ecx, dword [edx - 8]
inc ecx
jle 0x4037a7
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x403718
ret

Function at 0x4051d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405209
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040324c
jmp 0x405212
mov eax, ebx
mov edx, esi
call fcn.00403200
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40521c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x40523d
mov al, byte [esp]
jmp 0x40523f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x405904
Capabilities:
Contain obfuscated stackstrings

Disassembly:
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00405603
fistp word [edx + 0x458d7e02]
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x405974
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00405613
push eax
push esi
push dword [ebp + 8]
call fcn.004055c8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00405613
push eax
push esi
push dword [ebp + 8]
call fcn.004055c8
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00405613
push eax
push esi
push dword [ebp + 8]
call fcn.004055c8
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00405603
cmp ebp, ecx
xchg ebx, eax
adc byte [eax - 0x8363], cl
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid

Function at 0x407864
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x407880
shr eax, 1
xor eax, 0xedb88320
jmp 0x407882
shr eax, 1
dec edx
jne 0x407873
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40786c
pop esi
ret

Function at 0x4078af
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078bb
call fcn.00407864
push 1
push 0x40c558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4078e6
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078c1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x10004912
Capabilities:
Query environment variable

Disassembly:
jmp 0x1008643e
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10086452
xor edi, edi
jmp 0x10086489
push ebx
push esi
call fcn.10086347
sub eax, esi
sar eax, 1
lea ebx, [eax + eax]
push ebx
call fcn.1000419c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10086479
push ebx
push esi
push edi
call fcn.10002135
add esp, 0xc
push 0
call fcn.10002815
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x10004a48
Capabilities:
Terminate process

Disassembly:
jmp 0x100795af
push 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x100795bf
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.10002383
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x100264a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x100bdbe8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100264fb
mov ecx, dword [ebp - 0x194]
mov eax, ecx
shr eax, 8
movzx edx, al
movzx eax, cl
lea eax, [eax + eax*4]
lea eax, [edx + eax*2]
cmp eax, 0x16
jge 0x100264fb
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003f44
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.10003f44
mov esp, ebp
pop ebp
ret
Function at 0x410598
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0041017c
push eax
push esi
push dword [ebp + 8]
call fcn.00410131
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0041016c
movsb byte es:[edi], byte [esi]
and esi, 0x22
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
jmp 0xffc0a38d
invalid
inc esi
inc ebp
adc byte [ecx - 0x3a], 0x45
xor dword [ebx - 0x3a], 0xc6628245
inc ebp
sbb dword [ebx - 0x3a], 0x45
test byte [ecx - 0x3a], bh
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jb 0x410602
inc ebp
lea edi, [edx - 0x3a]
inc ebp
invalid
jae 0x41060a
inc ebp
invalid
push edi
mov byte [ebp - 0x70], 0x16
call fcn.0041016c
dec edi
sar dword [ebx + edx*2 - 0x73], 0x85
jl 0x410657
invalid
invalid
Function at 0x411cf1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add byte [eax - 0x78b5b], al
inc dword [eax]
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.0041017c
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.004100dd
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x4120e4

Function at 0x4139fd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push 0x208
xor esi, esi
push esi
push eax
call fcn.0042f670
add esp, 0xc
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x413a9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x271
push str.logging.cpp
call fcn.004037d3
push str.Failed_to_get_temp_folder.
push esi
call fcn.0044012f
pop ecx
pop ecx
jmp 0x413b88
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00401c57
mov esi, eax
test esi, esi
jns 0x413abc
push str.Failed_to_get_length_of_temp_folder.
jmp 0x413a8e
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x413b60
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push 0x453e34
push eax
call fcn.00401f20
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x413b00
push str.Failed_to_format_session_id_as_a_string.
jmp 0x413b7f
lea eax, [ebp - 0x214]
push eax
push SysReAllocString
push dword [ebp - 0x210]
call fcn.00401c57
mov esi, eax
test esi, esi
jns 0x413b24
push str.Failed_to_get_length_of_session_id_string.
jmp 0x413b7f
push dword [ebp - 0x214]
mov edi, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
mov esi, edi
sub esi, dword [ebp - 0x214]
push dword [ebp - 0x214]
lea eax, [eax + esi*2]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
cmove edi, esi
jmp 0x413b66
mov edi, dword [ebp - 0x218]
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004021a5
mov esi, eax
test esi, esi
jns 0x413b87
push str.Failed_to_copy_temp_folder.
push esi
call fcn.0044012f
pop ecx
pop ecx
pop edi
cmp dword [ebp - 0x210], 0
je 0x413b9c
push dword [ebp - 0x210]
call fcn.004454ef
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042de36
mov esp, ebp
pop ebp
ret 4