joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61092f90
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ecx, 0x21
mov ebp, esp
push edi
mov edi, 0xffffffff
push esi
push ebx
sub esp, 0x37c
lea ebx, [ebp - 0x368]
mov dword [esp], 0
mov edx, dword [ebp + 8]
mov eax, ebx
mov esi, dword [ebp + 0xc]
call fcn.610620e0
mov eax, dword [ebp - 0x140]
test eax, eax
jne 0x610931c0
mov eax, dword [ebp - 0x138]
test eax, eax
je 0x61093070
cmp eax, 0xf7
je 0x61093058
cmp eax, 0xfc
je 0x61093058
test eax, eax
je 0x61093000
cmp eax, 0xf7
je 0x61093000
cmp byte [ebp - 0x12c], 0
jne 0x61093058
mov esi, esi
xor edi, edi
lea esi, [esi]
lea edi, [edi]
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x61093023
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x18], esi
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x61092f75
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0x61092f50
mov dword [esp + 4], 0x10
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61093019
test eax, eax
je 0x61093070
cmp eax, 0xf7
je 0x61093070
cmp byte [ebx + 0x23c], 0
jne 0x610931ac
mov eax, dword [ebp - 0x368]
mov edx, 0x3ca
cmp eax, 0xffffffff
je 0x61093180
and eax, 0xfffffffe
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_SetFileAttributesA
mov eax, dword [ebp - 0x368]
sub esp, 8
xor edx, edx
cmp eax, 0xffffffff
je 0x610930c0
test al, 0x10
je 0x610930c0
mov edx, 1
lea esi, [esi]
lea edi, [edi]
test edx, edx
je 0x610930ca
or esi, 0x4000
mov dword [esp + 0x10], esi
mov eax, dword [ebp - 0x148]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0xffffffff
and eax, 0x80000000
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.6107eb60
sub esp, 0x14
test eax, eax
jne 0x6109310b
xor eax, eax
cmp byte [0x61146ea0], 0
setne al
dec eax
and edi, eax
test esi, 0x92
je 0x610931a0
and dword [ebp - 0x368], 0xfffffffe
test byte [ebp - 0x145], 1
jne 0x61093135
mov eax, esi
and eax, 0xf000
cmp eax, 0xa000
je 0x61093190
mov eax, esi
and eax, 0xf000
cmp eax, 0xc000
je 0x61093190
mov dword [esp], ebx
mov eax, dword [ebp - 0x368]
mov dword [esp + 4], eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
test eax, eax
je 0x61093170
xor eax, eax
cmp byte [0x61146ea0], 0
sete al
dec eax
and edi, eax
jmp 0x61093010
mov edx, 0x3e2
lea esi, [esi]
lea edi, [edi]
mov eax, 0x61090c10
call fcn.61022e70
jmp 0x61093010
or dword [ebp - 0x368], 4
jmp 0x61093143
or dword [ebp - 0x368], 1
jmp 0x6109311e
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.61092ef0
mov edi, eax
jmp 0x61093010
call sym.cygwin1.dll___errno
mov edx, dword [ebp - 0x140]
mov dword [eax], edx
jmp 0x61093010
Function at 0x61094450
Capabilities:
Get disk information

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x61148914]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
movzx eax, byte [eax + 0xc]
shr al, 5
and eax, 1
test al, al
je 0x61094486
cmp dword [ebp + 0xc], 0x5a
je 0x61094550
cmp byte [0x61146ea0], 0
jne 0x61094490
xor edx, edx
mov ebx, dword [ebp - 4]
mov eax, edx
mov esp, ebp
pop ebp
ret
mov dword [esp], ebx
call sym.cygwin1.dll__strlen
add eax, 0xf
and eax, 0xfffffff0
call sym.cygwin1.dll__alloca
mov dword [esp + 4], ebx
lea eax, [esp + 0x20]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
call fcn.61029d20
cmp byte [0x61146ea1], 0
mov ebx, eax
jne 0x610944d8
cmp byte [eax], 0x5c
je 0x6109453e
mov dword [esp], ebx
call sub.KERNEL32.dll_GetDriveTypeA
sub esp, 4
cmp eax, 4
je 0x61094484
mov dword [esp + 0x1c], 0x10
lea eax, [ebp - 8]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.KERNEL32.dll_GetVolumeInformationA
sub esp, 0x20
test eax, eax
je 0x6109452a
mov edx, dword [ebp - 8]
shr edx, 3
and edx, 1
jmp 0x61094486
mov edx, 0x5c1
mov eax, 0x61090c10
call fcn.61022e70
jmp 0x61094484
cmp byte [eax + 1], 0x5c
jne 0x610944c8
jmp 0x61094484
cmp byte [0x611462b0], 0
je 0x6109447b
mov edx, 1
jmp 0x61094486
Function at 0x61095330
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], 0xffffffff
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test esi, esi
js 0x610954c2
mov dword [esp + 0xc], 1
lea eax, [ebp - 0x28]
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.610e7290
mov edx, dword [ebp - 0x24]
test edx, edx
js 0x610953ad
mov eax, dword [0x610ed768]
add eax, 0x18c
mov eax, dword [eax + 4]
mov eax, dword [eax + edi*4]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 0xc0]
mov eax, dword [eax]
test eax, eax
jne 0x61095422
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0x6110d570
jne 0x61095410
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x610953d0
mov eax, dword [ebp - 0x2c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x18], ebx
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x61095314
mov dword [esp + 8], 0x610952f0
mov dword [esp + 4], 0x10
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x610953c3
mov eax, dword [0x610ed768]
mov eax, dword [eax + 0x18c]
call fcn.61090890
jmp 0x610953ba
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov edx, dword [eax]
mov dword [esp + 0xc], 1
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [edx + 0x58]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], edx
mov eax, dword [eax]
mov edx, dword [eax]
mov dword [esp + 0xc], 0
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [edx + 0x58]
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sub.KERNEL32.dll_SetEndOfFile
sub esp, 4
test eax, eax
je 0x610954b1
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
mov eax, dword [eax]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [ebp - 0x3c], edx
mov edx, dword [ebp - 0x38]
mov dword [esp], eax
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 4], edx
call dword [ecx + 0x58]
jmp 0x610953ad
mov edx, 0x6c4
mov eax, 0x61090c10
call fcn.61022e70
jmp 0x61095483
call sym.cygwin1.dll___errno
mov dword [eax], 0x16
jmp 0x610953ba

Function at 0x6109e640
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
mov dword [esp + 4], 0xdf0df047
mov dword [esp], esi
call fcn.6109ffd0
mov dword [esi], 0x6110d028
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
call sub.KERNEL32.dll_TlsAlloc
mov dword [esi + 8], eax
inc eax
je 0x6109e69f
test esi, esi
mov ebx, 0x611486dc
je 0x6109e697
lea esi, [esi]
mov edi, dword [0x611486dc]
mov ecx, ebx
mov edx, esi
mov dword [esi + 0xc], edi
mov eax, edi
lock cmpxchg dword [ecx], edx
cmp eax, edi
jne 0x6109e680
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esi + 4], 0
jmp 0x6109e697
Function at 0x610a0c90
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.610a02f0
test al, al
mov edx, 3
je 0x610a0cb7
mov eax, dword [ebx]
cmp byte [eax + 0x35], 0
je 0x610a0cc0
xor edx, edx
mov ebx, dword [ebp - 4]
mov eax, edx
mov esp, ebp
pop ebp
ret
mov byte [eax + 0x35], 1
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_SuspendThread
sub esp, 4
jmp 0x610a0cb5

Function at 0x610a0ce0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.610a02f0
test al, al
mov edx, 3
je 0x610a0d0b
mov eax, dword [ebx]
cmp byte [eax + 0x35], 1
je 0x610a0d14
mov byte [eax + 0x35], 0
xor edx, edx
mov ebx, dword [ebp - 4]
mov eax, edx
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_ResumeThread
mov eax, dword [ebx]
sub esp, 4
jmp 0x610a0d05

Function at 0x610a4e00
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
lea eax, [ebx + 0x90]
mov dword [esp + 4], eax
lea eax, [ebx + 0x8c]
mov dword [esp + 0xc], 0x20000
mov dword [esp + 8], 0x610ef794
mov dword [esp], eax
call sub.KERNEL32.dll_CreatePipe
sub esp, 0x10
test eax, eax
jne 0x610a4e87
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x610a4e61
call sym.cygwin1.dll___errno
mov dword [eax], 2
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 0xc], 0x610a4d5b
mov dword [esp + 8], 0x610a4d30
mov dword [esp + 4], 0x100
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x610a4e4a
mov dword [esp + 0xc], 0x20000
lea eax, [ebx + 0x98]
mov dword [esp + 4], eax
lea eax, [ebx + 0x94]
mov dword [esp + 8], 0x610ef794
mov dword [esp], eax
call sub.KERNEL32.dll_CreatePipe
sub esp, 0x10
test eax, eax
jne 0x610a4ed0
mov eax, dword [0x610f08a0]
test eax, eax
je 0x610a4e4a
mov dword [esp + 0xc], 0x610a4d73
jmp 0x610a4e69
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x610a4f5e
mov dword [esp + 0xc], 0
lea eax, [ebp - 0xc]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x90]
mov dword [ebp - 0xc], 1
mov dword [esp], eax
call sub.KERNEL32.dll_SetNamedPipeHandleState
sub esp, 0x10
test eax, eax
jne 0x610a4f19
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x610a4f38
mov eax, dword [ebx + 0x94]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x90]
mov dword [esi + 0x394], eax
mov eax, 1
jmp 0x610a4e57
mov dword [esp + 0xc], 0x610a4d90
mov dword [esp + 8], 0x610a4d30
mov dword [esp + 4], 0x100
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x610a4f19
mov eax, dword [ebx + 0x90]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x94]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0xc], 0x610a4dd0
mov dword [esp + 8], 0x610a4d30
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x100
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x610a4edd
Function at 0x610a6e40
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov edx, 0x64
mov ebp, esp
push esi
push ebx
sub esp, 0x60
mov esi, dword [ebp + 8]
mov eax, esi
call fcn.61055380
test eax, eax
mov edx, 0xffffffff
jne 0x610a6f9d
mov dword [esp + 4], 0x610a6e10
mov eax, dword [0x610e994c]
mov dword [esp], eax
call sym.cygwin1.dll__strstr
mov dword [esp + 8], 0x64
mov ebx, eax
mov dword [esp + 4], 0
mov dword [esp], esi
call sym.cygwin1.dll__memset
mov dword [esp + 8], 0x611488ec
mov dword [esp + 4], 0x610a6e14
mov dword [esp], esi
call fcn.6108c610
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemInfo
sub esp, 4
lea eax, [esi + 0x14]
mov dword [esp + 4], 0x13
mov dword [esp], eax
call fcn.6105b870
movzx eax, word [0x610e994a]
test ebx, ebx
mov dword [esp + 0x24], eax
movzx eax, word [0x610e9948]
mov dword [esp + 0x20], eax
movzx eax, word [0x610e9942]
mov dword [esp + 0x1c], eax
movzx eax, word [0x610e9940]
mov dword [esp + 0x18], eax
mov eax, 0x610a6e1e
je 0x610a7037
movzx ecx, word [0x610e9944]
mov edx, 0x10624dd3
mov dword [esp + 0x14], eax
movzx eax, word [0x610e9946]
mov dword [esp + 4], 0x610a6e20
mov dword [esp + 0x10], eax
mov eax, ecx
mul edx
shr edx, 6
mov eax, edx
imul eax, eax, 0x3e8
movzx edx, dx
mov dword [esp + 8], edx
sub ecx, eax
movzx ecx, cx
mov dword [esp + 0xc], ecx
lea eax, [esi + 0x28]
mov dword [esp], eax
call fcn.6108c610
mov eax, dword [0x610e994c]
mov dword [esp + 4], eax
lea eax, [esi + 0x3c]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
test ebx, ebx
je 0x610a6f76
mov eax, dword [0x610e994c]
sub ebx, eax
mov byte [ebx + esi + 0x3c], 0
movzx eax, word [ebp - 0x38]
cmp eax, 1
je 0x610a7027
cmp eax, 1
jle 0x610a6fb5
cmp eax, 2
je 0x610a6fa6
mov dword [esi + 0x50], 0x6e6b6e75
mov dword [esi + 0x54], 0x6e776f
xor edx, edx
lea esp, [ebp - 8]
mov eax, edx
pop ebx
pop esi
pop ebp
ret
mov dword [esi + 0x50], 0x68706c61
mov word [esi + 0x54], 0x61
jmp 0x610a6f9b
test eax, eax
jne 0x610a6f8d
mov eax, dword [0x61148914]
movzx eax, byte [eax + 0xf]
shr al, 5
and eax, 1
test al, al
je 0x610a7001
mov eax, dword [ebp - 0x18]
mov ecx, 3
cmp ax, 2
jbe 0x610a6fe8
cmp ax, 9
mov ecx, 6
ja 0x610a6fe8
movzx ecx, ax
mov dword [esp + 8], ecx
lea eax, [esi + 0x50]
mov dword [esp + 4], 0x610a6e38
mov dword [esp], eax
call fcn.6108c610
jmp 0x610a6f9b
mov ebx, dword [ebp - 0x20]
cmp ebx, 0x182
je 0x610a7019
cmp ebx, 0x1e6
mov ecx, 5
jne 0x610a6fe8
mov eax, 0x51eb851f
mul ebx
mov ecx, edx
shr ecx, 5
jmp 0x610a6fe8
mov dword [esi + 0x50], 0x7370696d
mov byte [esi + 0x54], 0
jmp 0x610a6f9b
mov eax, 0x610a6e3e
jmp 0x610a6f05
Function at 0x610a8d60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov eax, dword [ebx + 0xc4]
test eax, eax
je 0x610a8d90
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
cld
mov ecx, 0x27
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [ebx], 0x94
mov dword [esp], ebx
call sub.KERNEL32.dll_GetVersionExA
mov eax, dword [ebx + 0x10]
sub esp, 4
cmp eax, 1
je 0x610a8ee7
cmp eax, 2
je 0x610a8dfb
mov dword [ebp - 0x10], 0x610a8d20
mov eax, 0x610f0dc0
mov dword [ebx + 0xc4], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
mov dword [esp + 4], 0x610a8d23
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
lea eax, [ebx + 0x9c]
mov dword [esp], eax
call fcn.6108c610
jmp 0x610a8d7c
mov eax, dword [ebx + 4]
cmp eax, 4
je 0x610a8e7d
cmp eax, 4
ja 0x610a8e21
cmp eax, 3
jne 0x610a8dbc
mov dword [ebp - 0x10], 0x610a8d2c
mov edx, 0x610f0e38
mov dword [ebx + 0xc4], edx
jmp 0x610a8dce
cmp eax, 5
jne 0x610a8dbc
mov dword [ebp - 0x10], 0x610a8d2c
mov eax, dword [ebx + 8]
test eax, eax
je 0x610a8e76
dec eax
je 0x610a8e6f
mov eax, 0x610f0e9c
mov dword [ebx + 0xc4], eax
mov dword [ebx], 0x9c
mov dword [esp], ebx
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
cmp byte [ebx + 0x9a], 1
je 0x610a8dce
mov eax, dword [ebx + 0xc4]
or byte [eax + 0xc], 2
jmp 0x610a8dce
mov eax, 0x610f0e88
jmp 0x610a8e3c
mov eax, 0x610f0e74
jmp 0x610a8e3c
mov dword [ebp - 0x10], 0x610a8d2c
lea esi, [ebx + 0x14]
mov edi, 0x610a8d2f
mov dword [ebp - 0x14], esi
mov ecx, 0xf
cld
repe cmpsb byte [esi], byte es:[edi]
setb al
seta dl
sub dl, al
mov al, dl
test eax, 0x80
jne 0x610a8edd
cld
mov esi, dword [ebp - 0x14]
mov eax, 0x610f0e60
mov dword [ebx + 0xc4], eax
mov edi, 0x610a8d3e
mov ecx, 0xf
repe cmpsb byte [esi], byte es:[edi]
setb al
seta dl
sub dl, al
mov al, dl
test eax, 0x80
je 0x610a8e42
jmp 0x610a8dce
mov eax, 0x610f0e4c
jmp 0x610a8dc8
mov eax, dword [ebx + 8]
cmp eax, 0x5a
je 0x610a8f8e
cmp eax, 0x5a
ja 0x610a8dbc
test eax, eax
je 0x610a8f50
cmp eax, 0xa
jne 0x610a8dbc
mov dword [ebp - 0x10], 0x610a8d4d
lea edx, [ebx + 0x14]
mov eax, 0x41
mov ah, al
mov al, byte [edx]
cmp al, ah
je 0x610a8f27
inc edx
test al, al
jne 0x610a8f1a
xor edx, edx
mov eax, edx
test eax, eax
je 0x610a8f3d
mov esi, 0x610f0e10
mov dword [ebx + 0xc4], esi
jmp 0x610a8dce
mov ecx, 0x610f0dfc
mov dword [ebx + 0xc4], ecx
jmp 0x610a8dce
mov dword [ebp - 0x10], 0x610a8d50
lea edx, [ebx + 0x14]
mov eax, 0x43
mov ah, al
mov al, byte [edx]
cmp al, ah
je 0x610a8f6e
inc edx
test al, al
jne 0x610a8f61
xor edx, edx
mov eax, edx
test eax, eax
je 0x610a8f7e
mov eax, 0x610f0de8
jmp 0x610a8dc8
mov edi, 0x610f0dd4
mov dword [ebx + 0xc4], edi
jmp 0x610a8dce
mov dword [ebp - 0x10], 0x610a8d53
mov edx, 0x610f0e24
jmp 0x610a8e19
Function at 0x4054c2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00404caa
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404c5f
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
invalid
movsd dword es:[edi], dword [esi]
invalid
Function at 0x405b6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00404c78
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00404caa
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404c5f
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00404c9a
sub eax, 0x685bae4e
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.00404c9a
loop 0x405ca1
add dword [eax - 0x7fff1f9b], 0xc600e165
inc ebp
loop 0x405cdd
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.00404caa
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404c5f
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
inc ebp
ljmp 0xc6b2

Function at 0x406995
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
invalid
invalid
Function at 0x3001ed97
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3004d9c0]
jne 0x30022520
repz ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x3004fda0], eax
mov dword [0x3004fd9c], ecx
mov dword [0x3004fd98], edx
mov dword [0x3004fd94], ebx
mov dword [0x3004fd90], esi
mov dword [0x3004fd8c], edi
mov word [0x3004fdb8], ss
mov word [0x3004fdac], cs
mov word [0x3004fd88], ds
mov word [0x3004fd84], es
mov word [0x3004fd80], fs
mov word [0x3004fd7c], gs
pushfd
pop dword [0x3004fdb0]
mov eax, dword [ebp]
mov dword [0x3004fda4], eax
mov eax, dword [ebp + 4]
mov dword [0x3004fda8], eax
lea eax, [ebp + 8]
mov dword [0x3004fdb4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x3004fcf0], 0x10001
mov eax, dword [0x3004fda8]
mov dword [0x3004fca4], eax
mov dword [0x3004fc98], 0xc0000409
mov dword [0x3004fc9c], 1
mov eax, dword [0x3004d9c0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x3004d9c4]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x3004fce8], eax
push 1
call fcn.3002271b
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x30008668
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x3004fce8], 0
jne 0x30022610
push 1
call fcn.3002271b
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x211e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0211e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x211e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x211e06a
add dl, dl
jne 0x211e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x211e0dc
xor eax, eax
add dl, dl
jne 0x211e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x211e17d
add dl, dl
jne 0x211e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x211e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x211e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x211e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x211e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x211e075
mov eax, 1
add dl, dl
jne 0x211e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x211e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x211e0e1
sub eax, ebx
mov ebx, 1
jne 0x211e128
mov ecx, 1
add dl, dl
jne 0x211e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x211e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x211e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x211e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x211e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x211e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x211e136
cmp eax, 0x7d00
jae 0x211e16d
cmp eax, 0x500
jb 0x211e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x211e075
cmp eax, 0x7f
ja 0x211e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x211e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x211e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x211e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx