joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d5e7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0x1c
xor edx, edx
pop ecx
div ecx
test edx, edx
jne 0x40d7cd
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, 0x4014e0
push 0x401db8
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 8], eax
call fcn.004120f1
and byte [ebp - 0x15], 0
lea eax, [ebp - 0x20]
push eax
push ebx
mov byte [ebp - 0x20], 0x6d
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x5f
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x76
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x6e
mov byte [ebp - 0x16], 0x74
call esi
push eax
call edi
mov dword [ebp - 4], eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
push 0x401dac
push ebx
call esi
push eax
call edi
push 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
pop ecx
div ecx
mov ecx, eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
xor ebx, ebx
cmp ecx, ebx
jle 0x40d7cd
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], ecx
lea esi, [eax + 8]
mov eax, dword [esi - 4]
cmp eax, 0x200
jb 0x40d6eb
cmp eax, 0x208
ja 0x40d6eb
mov edi, dword [esi + 4]
movzx eax, word [esi + 4]
shr edi, 0x10
push edi
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_SetCursorPos]
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_WindowFromPoint]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov ecx, dword [esi - 4]
mov eax, 0x203
cmp ecx, eax
ja 0x40d764
je 0x40d753
sub ecx, 0x100
je 0x40d74f
dec ecx
je 0x40d73d
sub ecx, 3
je 0x40d74f
dec ecx
je 0x40d73d
sub ecx, 0xfc
je 0x40d732
dec ecx
jne 0x40d7c1
push ebx
push ebx
push ebx
push ebx
push 4
jmp 0x40d7be
push ebx
push ebx
push ebx
push ebx
push 2
jmp 0x40d7be
push ebx
push 2
push ebx
push dword [esi]
call dword [ebp - 8]
push eax
mov al, byte [esi]
push eax
call dword [ebp - 0xc]
jmp 0x40d7c1
push ebx
push ebx
jmp 0x40d740
push ebx
push ebx
push ebx
push ebx
push 6
call dword [ebp - 4]
push ebx
push ebx
push ebx
push ebx
push 6
jmp 0x40d7be
sub ecx, 0x204
je 0x40d7b8
dec ecx
je 0x40d7b0
dec ecx
je 0x40d79f
dec ecx
je 0x40d797
dec ecx
je 0x40d78f
dec ecx
dec ecx
jne 0x40d7c1
mov eax, dword [esi]
push ebx
shr eax, 0x10
movsx eax, ax
push eax
push ebx
push ebx
push 0x800
jmp 0x40d7be
push ebx
push ebx
push ebx
push ebx
push 0x40
jmp 0x40d7be
push ebx
push ebx
push ebx
push ebx
push 0x20
jmp 0x40d7be
push ebx
push ebx
push ebx
push ebx
push 0x18
call dword [ebp - 4]
push ebx
push ebx
push ebx
push ebx
push 0x18
jmp 0x40d7be
push ebx
push ebx
push ebx
push ebx
push 0x10
jmp 0x40d7be
push ebx
push ebx
push ebx
push ebx
push 8
call dword [ebp - 4]
add esi, 0x1c
dec dword [ebp + 0xc]
jne 0x40d6b4
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40d7d4
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and byte [ebp - 0xa], 0
push 0
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x6b
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40d913
push ebx
push esi
push edi
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x14]
mov ebx, 0x4013b0
push eax
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_EmptyClipboard]
and byte [ebp - 0x15], 0
lea eax, [ebp - 0x20]
push eax
push ebx
mov byte [ebp - 0x20], 0x47
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x62
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x41
mov byte [ebp - 0x19], 0x6c
mov byte [ebp - 0x18], 0x6c
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x63
call esi
push eax
call edi
push dword [ebp + 0xc]
push 0x2000
call eax
test eax, eax
mov dword [ebp - 4], eax
je 0x40d90a
push eax
call dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, 1
mov eax, 0xffffffff
nop
nop
and byte [ebp - 0x24], 0
lea eax, [ebp - 0x30]
push eax
push ebx
mov byte [ebp - 0x30], 0x47
mov byte [ebp - 0x2f], 0x6c
mov byte [ebp - 0x2e], 0x6f
mov byte [ebp - 0x2d], 0x62
mov byte [ebp - 0x2c], 0x61
mov byte [ebp - 0x2b], 0x6c
mov byte [ebp - 0x2a], 0x55
mov byte [ebp - 0x29], 0x6e
mov byte [ebp - 0x28], 0x6c
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x6b
call esi
push eax
call edi
push dword [ebp - 4]
call eax
push dword [ebp - 4]
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40d917
Capabilities:
Contain obfuscated stackstrings
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x401dc8
push 0x4014e0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40da4c
push 1
call ebx
test eax, eax
mov dword [ebp - 4], eax
jne 0x40d972
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x40da4c
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov eax, 1
mov eax, 0xffffffff
nop
nop
and byte [ebp - 0xe], 0
lea eax, [ebp - 0x18]
mov ebx, 0x4013b0
push eax
push ebx
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x62
mov byte [ebp - 0x14], 0x61
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x53
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0x10], 0x7a
mov byte [ebp - 0xf], 0x65
call esi
push eax
call edi
and byte [ebp - 0x1a], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
mov byte [ebp - 0x24], 0x47
push eax
push ebx
mov byte [ebp - 0x23], 0x6c
mov byte [ebp - 0x22], 0x6f
mov byte [ebp - 0x21], 0x62
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0x4c
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x63
mov byte [ebp - 0x1b], 0x6b
call esi
push eax
call edi
push dword [ebp - 4]
mov edi, eax
call dword [ebp - 8]
push dword [ebp - 4]
mov esi, eax
inc esi
call edi
push esi
mov ebx, eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
lea eax, [esi - 1]
push eax
push ebx
lea eax, [edi + 1]
mov byte [edi], 0x76
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0xc]
push esi
push edi
call fcn.0040cd61
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40dc00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and byte [ebp - 3], 0
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
mov esi, ecx
push eax
push 0x4014e0
mov dword [esi], 0x403384
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x79
mov byte [ebp - 9], 0x43
mov byte [ebp - 8], 0x75
mov byte [ebp - 7], 0x72
mov byte [ebp - 6], 0x73
mov byte [ebp - 5], 0x6f
mov byte [ebp - 4], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10
mov ebx, eax
add esi, 0x44
pop edi
push dword [esi]
call ebx
add esi, 4
dec edi
jne 0x40dc67
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40dcae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x419c5f
call fcn.004196c0
sub esp, 0x40
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
mov dword [esi], 0x40337c
mov dword [ebp - 4], 1
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and byte [ebp - 0x25], 0
lea eax, [ebp - 0x38]
mov byte [ebp - 0x38], 0x49
push eax
push 0x4013b0
mov byte [ebp - 0x37], 0x6e
mov byte [ebp - 0x36], 0x74
mov byte [ebp - 0x35], 0x65
mov byte [ebp - 0x34], 0x72
mov byte [ebp - 0x33], 0x6c
mov byte [ebp - 0x32], 0x6f
mov byte [ebp - 0x31], 0x63
mov byte [ebp - 0x30], 0x6b
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x64
mov byte [ebp - 0x2d], 0x45
mov byte [ebp - 0x2c], 0x78
mov byte [ebp - 0x2b], 0x63
mov byte [ebp - 0x2a], 0x68
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x6e
mov byte [ebp - 0x27], 0x67
mov byte [ebp - 0x26], 0x65
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
and byte [ebp - 0x19], 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
mov byte [ebp - 0x24], 0x43
push eax
push 0x4013b0
mov byte [ebp - 0x23], 0x6c
mov byte [ebp - 0x22], 0x6f
mov byte [ebp - 0x21], 0x73
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x48
mov byte [ebp - 0x1e], 0x61
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x65
call edi
push eax
call ebx
mov dword [ebp - 0x14], eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
and byte [ebp - 0x39], 0
lea eax, [ebp - 0x4c]
mov byte [ebp - 0x4c], 0x57
mov byte [ebp - 0x4b], 0x61
mov byte [ebp - 0x4a], 0x69
mov byte [ebp - 0x49], 0x74
mov byte [ebp - 0x48], 0x46
mov byte [ebp - 0x47], 0x6f
mov byte [ebp - 0x46], 0x72
mov byte [ebp - 0x45], 0x53
mov byte [ebp - 0x44], 0x69
mov byte [ebp - 0x43], 0x6e
mov byte [ebp - 0x42], 0x67
mov byte [ebp - 0x41], 0x6c
mov byte [ebp - 0x40], 0x65
mov byte [ebp - 0x3f], 0x4f
mov byte [ebp - 0x3e], 0x62
mov byte [ebp - 0x3d], 0x6a
mov byte [ebp - 0x3c], 0x65
mov byte [ebp - 0x3b], 0x63
mov byte [ebp - 0x3a], 0x74
push eax
push 0x40131c
call edi
push eax
call ebx
mov edi, eax
lea eax, [esi + 0x12]
push 0
push eax
call dword [ebp - 0x10]
lea eax, [esi + 0x10]
push 0
push eax
call dword [ebp - 0x10]
push 0xffffffffffffffff
push dword [esi + 0x1c]
call edi
push 0xffffffffffffffff
push dword [esi + 0x20]
call edi
push dword [esi + 0x1c]
call dword [ebp - 0x14]
push dword [esi + 0x20]
call dword [ebp - 0x14]
mov ecx, dword [esi + 0xa8]
test ecx, ecx
je 0x40de32
mov eax, dword [ecx]
push 1
call dword [eax]
and byte [ebp - 4], 0
lea ecx, [esi + 0x24]
call fcn.0040dc00
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040cd4e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40de58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x419c8a
call fcn.004196c0
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and byte [ebp - 0x11], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x1c], 0x43
push eax
push 0x4013b0
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x48
mov byte [ebp - 0x16], 0x61
mov byte [ebp - 0x15], 0x6e
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x65
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
and byte [ebp - 0x1d], 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x30]
mov byte [ebp - 0x30], 0x57
push eax
push 0x40131c
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x69
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x46
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x53
mov byte [ebp - 0x28], 0x69
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x67
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x4f
mov byte [ebp - 0x22], 0x62
mov byte [ebp - 0x21], 0x6a
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x63
mov byte [ebp - 0x1e], 0x74
call edi
push eax
call ebx
and byte [esi + 0x10], 0
push 0xffffffffffffffff
push dword [esi + 0x1c]
call eax
push dword [esi + 0x1c]
call dword [ebp - 0x10]
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov ecx, dword [esi + 0xa8]
xor edi, edi
push 1
cmp ecx, edi
pop ebx
je 0x40df52
mov eax, dword [ecx]
push ebx
call dword [eax]
cmp dword [ebp + 8], 3
jne 0x40df74
push 0x110
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, edi
mov dword [ebp - 4], edi
je 0x40dfb9
push 0x64
push ebx
push 4
jmp 0x40df94
cmp dword [ebp + 8], 7
push 0x110
jne 0x40df9d
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, edi
mov dword [ebp - 4], ebx
je 0x40dfb9
push 0x64
push ebx
push 8
mov ecx, eax
call fcn.0040eba2
jmp 0x40dfbb
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, edi
mov dword [ebp - 4], 2
je 0x40dfb9
push 0x64
push edi
push dword [ebp + 8]
jmp 0x40df94
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0xa8], eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
movzx eax, byte [esi + 0x13]
mov ecx, dword [esi + 0xa8]
push eax
call fcn.0040e5e6
mov al, byte [esi + 0x14]
mov ecx, dword [esi + 0xa8]
push eax
call fcn.0040e8e0
mov eax, dword [ebp + 8]
push ebx
push edi
push edi
push esi
push 0x40e357
push edi
push edi
mov dword [esi + 0x18], eax
mov byte [esi + 0x10], bl
call fcn.0041193d
mov ecx, dword [ebp - 0xc]
add esp, 0x1c
mov dword [esi + 0x1c], eax
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40e171
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and byte [ebp - 0x10], 0
push ebx
push esi
lea eax, [ebp - 0x1c]
push edi
push eax
mov ebx, ecx
push 0x4013b0
mov byte [ebp - 0x1c], 0x56
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x18], 0x75
mov byte [ebp - 0x17], 0x61
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x41
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x63
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov ecx, dword [ebx + 0xa8]
call fcn.0040e97d
mov esi, eax
push 4
inc esi
push 0x1000
push esi
push 0
call edi
mov edi, eax
lea eax, [esi - 1]
push eax
mov byte [edi], 0x73
mov ecx, dword [ebx + 0xa8]
call fcn.0040e979
push eax
lea eax, [edi + 1]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, ebx
push esi
push edi
call fcn.0040cd61
and byte [ebp - 1], 0
lea eax, [ebp - 0xc]
push eax
push 0x4013b0
mov byte [ebp - 0xc], 0x56
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x75
mov byte [ebp - 7], 0x61
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x46
mov byte [ebp - 4], 0x72
mov byte [ebp - 3], 0x65
mov byte [ebp - 2], 0x65
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x8000
push 0
push edi
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40e5e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov eax, 1
mov eax, 0xffffffff
nop
nop
and byte [ebp - 1], 0
lea eax, [ebp - 0x14]
push eax
push 0x4013b0
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x6b
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x45
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x68
mov byte [ebp - 5], 0x61
mov byte [ebp - 4], 0x6e
mov byte [ebp - 3], 0x67
mov byte [ebp - 2], 0x65
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp + 8]
add esi, 4
push esi
call eax
pop esi
leave
ret 4
Function at 0x40e8e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and byte [ebp - 1], 0
lea eax, [ebp - 0x14]
push esi
push eax
mov esi, ecx
push 0x4013b0
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x6b
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x45
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x68
mov byte [ebp - 5], 0x61
mov byte [ebp - 4], 0x6e
mov byte [ebp - 3], 0x67
mov byte [ebp - 2], 0x65
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
cmp byte [ebp + 8], 0
mov eax, 0xcc0020
je 0x40e96d
mov eax, 0x40cc0020
add esi, 0x10
push eax
push esi
call ecx
pop esi
leave
ret 4

Function at 0x40e996
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and byte [ebp - 0x18], 0
lea eax, [ebp - 0x28]
mov ebx, 0x4014e0
push eax
push ebx
mov byte [ebp - 0x28], 0x47
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x74
mov byte [ebp - 0x25], 0x44
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x22], 0x6b
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x70
mov byte [ebp - 0x1e], 0x57
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x77
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 8], eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
and byte [ebp - 0xf], 0
lea eax, [ebp - 0x14]
push eax
push ebx
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0x10], 0x43
call esi
push eax
call edi
mov dword [ebp - 0xc], eax
call fcn.004120f1
mov bl, al
test bl, bl
je 0x40ea6c
mov edi, dword [ebp - 4]
push dword [edi + 0x44]
lea esi, [edi + 0x10c]
push dword [esi]
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [ebp - 8]
push eax
mov dword [esi], eax
call dword [ebp - 0xc]
mov dword [edi + 0x44], eax
pop edi
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x40f1e9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
and byte [ebp - 0xb], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x18]
push edi
mov ebx, 0x4014e0
push eax
mov dword [ebp - 8], ecx
push ebx
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x43
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0xc], 0x6f
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
and byte [ebp - 0x1b], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0x44
push eax
push ebx
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x73
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x79
mov byte [ebp - 0x21], 0x43
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x73
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x72
call esi
push eax
call edi
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x14
call dword [ebp - 4]
test eax, eax
je 0x40f2cb
cmp dword [ebp - 0x38], 1
jne 0x40f2cb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x34]
xor esi, esi
add eax, 0x44
cmp ecx, dword [eax]
je 0x40f2bf
inc esi
add eax, 4
cmp esi, 0x10
jl 0x40f2b2
push ecx
call edi
cmp esi, 0x10
je 0x40f2cb
mov eax, esi
jmp 0x40f2ce
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40fd2e
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x4014ec
push 0x4013b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 8]
push esi
call eax
xor ecx, ecx
test eax, eax
jle 0x40fd5c
xor byte [ecx + esi], 7
inc ecx
cmp ecx, eax
jl 0x40fd53
mov eax, esi
pop esi
ret
Function at 0x41013c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
and byte [ebp - 0x14], 0
lea eax, [ebp - 0x24]
push esi
push eax
push 0x401520
mov byte [ebp - 0x24], 0x52
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x67
mov byte [ebp - 0x21], 0x51
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x79
mov byte [ebp - 0x1c], 0x56
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x45
mov byte [ebp - 0x16], 0x78
mov byte [ebp - 0x15], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
and byte [ebp - 0x26], 0
push 4
mov esi, eax
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x54], 0x48
mov byte [ebp - 0x53], 0x41
mov byte [ebp - 0x52], 0x52
mov byte [ebp - 0x51], 0x44
mov byte [ebp - 0x50], 0x57
mov byte [ebp - 0x4f], 0x41
mov byte [ebp - 0x4e], 0x52
mov byte [ebp - 0x4d], 0x45
mov byte [ebp - 0x4c], 0x5c
mov byte [ebp - 0x4b], 0x44
mov byte [ebp - 0x4a], 0x45
mov byte [ebp - 0x49], 0x53
mov byte [ebp - 0x48], 0x43
mov byte [ebp - 0x47], 0x52
mov byte [ebp - 0x46], 0x49
mov byte [ebp - 0x45], 0x50
mov byte [ebp - 0x44], 0x54
mov byte [ebp - 0x43], 0x49
mov byte [ebp - 0x42], 0x4f
mov byte [ebp - 0x41], 0x4e
mov byte [ebp - 0x40], 0x5c
mov byte [ebp - 0x3f], 0x53
mov byte [ebp - 0x3e], 0x79
mov byte [ebp - 0x3d], 0x73
mov byte [ebp - 0x3c], 0x74
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x6d
mov byte [ebp - 0x39], 0x5c
mov byte [ebp - 0x38], 0x43
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x6e
mov byte [ebp - 0x35], 0x74
mov byte [ebp - 0x34], 0x72
mov byte [ebp - 0x33], 0x61
mov byte [ebp - 0x32], 0x6c
mov byte [ebp - 0x31], 0x50
mov byte [ebp - 0x30], 0x72
mov byte [ebp - 0x2f], 0x6f
mov byte [ebp - 0x2e], 0x63
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x73
mov byte [ebp - 0x2b], 0x73
mov byte [ebp - 0x2a], 0x6f
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x5c
mov byte [ebp - 0x27], 0x30
mov eax, 1
mov eax, 0xffffffff
nop
nop
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x54]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x401e10
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
pop esi
leave
ret