joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9951
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4de034]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4a999c
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004a9e13
test al, al
jne 0x4a9996
sub edx, 2
cmp edx, edi
jne 0x4a997c
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4a99be
lea eax, [edi + 2]
cmp edx, eax
je 0x4a99be
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004a954a
add esp, 0x10
jmp 0x4a9ab8
push esi
lea ecx, [ebp - 0x255]
call fcn.004a9e13
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a9a01
push dword [ebp - 0x25c]
jmp 0x4a99ae
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4a9a3e
cmp word [ebp - 0x226], 0
je 0x4a9a5f
cmp word [ebp - 0x226], ax
jne 0x4a9a3e
cmp word [ebp - 0x224], 0
je 0x4a9a5f
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004a954a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4a9aab
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4a9a18
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4a9a93
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4a9ab8
push 0x4a8f32
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00405bd7
add esp, 0x10
jmp 0x4a9a88
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040335a
leave
ret
Function at 0x40892b
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop eax
sub esp, 4
mov dword [esp], 0xd0acf820
pop esi
call fcn.00408955
xor dword [edi], eax
inc esi
inc esi
inc edi
cmp edi, ecx
jne fcn.0040892b
sub esi, 1
sub esi, esi
ret

Function at 0x440130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.tJrdyPER
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x440152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x440159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x440148
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x44016b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x440160
jne 0x44017c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440160
xor ecx, ecx
sub eax, 3
jb 0x440190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x440202
mov ebp, eax
add ebx, ebx
jne 0x44019b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4401a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4401cc
inc ecx
add ebx, ebx
jne 0x4401b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4401ad
jne 0x4401c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4401ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4401ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4401dd
jmp 0x44014e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4401ec
add edi, ecx
jmp 0x44014e
pop esi
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x440254
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4020c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x402b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x440209
push edi
pop ecx
jns 0x440238
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x402bc]
or eax, eax
je 0x44024e
mov dword [ebx], eax
add ebx, 4
jmp 0x440226
call dword [esi + 0x402b8]
mov ebp, dword [esi + 0x402c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x440288
sub esp, 0xffffff80
jmp section.NDltoTPW
Function at 0x10026440
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100264b1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x100264b1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.DLL_FlushInstructionCache]
test eax, eax
jne 0x1002649a
jmp 0x100264b1
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x337a7a00
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x7e083c0c
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401040
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push str.Executing_shellcode..._n
call fcn.00401010
add esp, 4
push 0x40
push 0x1000
push 3
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x401077
push str.Error_allocating_memory_for_shellcode._n
call fcn.00401010
add esp, 4
lea eax, [ebx + 1]
pop ebx
ret
push esi
push edi
push str.hello
call fcn.00401010
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
xor esi, esi
nop
push 0
call edi
mov al, byte [esi + 0x402190]
add al, 3
push esi
push 0x402158
mov byte [esi + 0x403378], al
call fcn.00401010
inc esi
add esp, 8
cmp esi, 3
jb 0x401090
xor esi, esi
mov eax, esi
imul eax, esi
push eax
push 0x40215c
call fcn.00401010
inc esi
add esp, 8
cmp esi, 0x64
jl 0x4010b8
push 3
push 3
push 3
push str._d__d__d
call fcn.00401010
add esp, 0x10
xor esi, esi
push 0
call edi
mov al, byte [esi + 0x403378]
sub al, 3
push esi
push 0x402158
mov byte [esi + 0x403374], al
call fcn.00401010
inc esi
add esp, 8
cmp esi, 3
jb 0x4010e6
pop edi
pop esi
push 0x40216c
call fcn.00401010
mov ax, word [0x403374]
mov word [ebx], ax
mov al, byte [0x403376]
mov byte [ebx + 2], al
call ebx
push str.Shellcode_execution_complete._n
call fcn.00401010
add esp, 8
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
pop ebx
ret

Function at 0x40194f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40198e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40198e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40198e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40198e
cmp dword [ecx + 0x74], 0xe
jbe 0x40198e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x402540
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x40
push eax
push 0x40fef4
call fcn.00402880
push 0x40
push 0x40e0c0
push 0x40fef4
push 0x40fef4
call fcn.004027a0
mov al, byte [esp + 0x3c]
add esp, 0x1c
test al, al
jne 0x4025cb
mov ebx, dword [esp + 0x1c]
mov ebp, 0x10
mov eax, dword [0x40f04c]
mov ecx, 8
mov esi, eax
mov edi, 0x40fed4
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004026e0
mov ecx, dword [0x40f048]
mov edx, dword [0x40f04c]
push 0x20
push ecx
push edx
call fcn.004027f0
mov edi, dword [0x40f048]
add esp, 0x14
mov ecx, 8
mov esi, 0x40fed4
add ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x40257f
jmp 0x402624
mov eax, dword [esp + 0x1c]
mov ebp, 0x10
lea ebx, [eax + 0x2d0]
mov eax, dword [0x40f048]
mov ecx, 8
mov esi, eax
mov edi, 0x40fed4
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004026e0
mov ecx, dword [0x40f04c]
mov edx, dword [0x40f048]
push 0x20
push ecx
push edx
call fcn.004027f0
mov edi, dword [0x40f04c]
add esp, 0x14
mov ecx, 8
mov esi, 0x40fed4
sub ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x4025da
push 0x40
push 0x40e100
push 0x40fef4
push 0x40fef4
call fcn.004027a0
mov eax, dword [esp + 0x24]
push 0x40
push 0x40fef4
push eax
call fcn.004028c0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x402660
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0x40
push eax
push 0x40fe94
call fcn.00402880
push 0x38
push str.91__
push 0x40fe94
push 0x40fe94
call fcn.004027a0
mov edi, dword [esp + 0x28]
add esp, 0x1c
xor esi, esi
movsx ecx, byte [esi + 0x40e1f8]
mov edx, dword [0x40f050]
push ecx
push 0x1c
push edx
call fcn.00402820
movsx eax, byte [esi + 0x40e1f8]
mov ecx, dword [0x40f054]
push eax
push 0x1c
push ecx
call fcn.00402820
push 0x30
push 0x40e1c8
push 0x40fe94
push edi
call fcn.004027a0
add esp, 0x28
inc esi
add edi, 0x30
cmp esi, 0x10
jl 0x402692
pop edi
pop esi
ret

Function at 0x4026e0
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x30
push 0x40e140
push esi
push 0x40fe64
call fcn.004027a0
mov eax, dword [esp + 0x1c]
push 0x30
push eax
push 0x40fe64
call fcn.004027f0
push 0x40fe64
push esi
call fcn.00402730
push 0x20
push 0x40e170
push esi
push esi
call fcn.004027a0
add esp, 0x34
pop esi
ret

Function at 0x4027f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x402812
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x402804
pop ebx
pop esi
ret
Function at 0x403d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
push esi
mov al, 0xd0
mov esi, ecx
mov byte [esp + 6], al
mov byte [esp + 7], al
mov al, 0x6e
mov dl, 0x5f
mov cl, 0x65
push edi
mov byte [esp + 8], 0xb7
mov byte [esp + 9], 0xe7
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], 0x32
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x34
mov byte [esp + 0x10], 0
mov byte [esp + 0x14], 0x66
mov byte [esp + 0x15], 0x75
mov byte [esp + 0x16], al
mov byte [esp + 0x17], 0x73
mov byte [esp + 0x18], 0x68
mov byte [esp + 0x19], 0x69
mov byte [esp + 0x1a], 0x6f
mov byte [esp + 0x1b], al
mov byte [esp + 0x1c], dl
mov byte [esp + 0x1d], 0x70
mov byte [esp + 0x1e], 0x6c
mov byte [esp + 0x1f], 0x61
mov byte [esp + 0x20], 0x79
mov byte [esp + 0x21], cl
mov byte [esp + 0x22], 0x72
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], 0x74
mov byte [esp + 0x25], 0x7a
mov byte [esp + 0x26], 0x64
mov byte [esp + 0x27], cl
mov byte [esp + 0x28], al
mov byte [esp + 0x29], 0x6a
mov byte [esp + 0x2a], 0x6f
mov byte [esp + 0x2b], 0x68
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], 0
xor edi, edi
mov ecx, dword [0x41066c]
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
call dword [ecx + 0x70]
test eax, eax
mov dword [esi], eax
jne 0x403e12
lea edx, [esp + 0x14]
push eax
push edx
push eax
push eax
mov eax, dword [0x41066c]
call dword [eax + 0x70]
mov dword [esi], eax
cmp dword [esi], 0
jne 0x403e2e
mov ecx, dword [0x41066c]
push 0x3e8
call dword [ecx + 0x104]
inc edi
cmp edi, 0xa
jl 0x403de6
mov esi, dword [esi]
test esi, esi
jne 0x403e3e
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret 8
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
pop edi
mov dword [edx], esi
mov dword [eax], 1
mov eax, 1
pop esi
add esp, 0x28
ret 8
Function at 0x403f26
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x80
push esi
mov esi, ecx
push edi
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
push 0x64
rep stosd dword es:[edi], eax
mov ecx, dword [0x41066c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x90]
lea eax, [esp + 0x28]
push eax
push edi
call dword [ecx + 0x64]
xor eax, eax
mov ax, word [esi + 0xc]
sub eax, 0
je 0x403fd1
dec eax
jne 0x40406d
mov dl, 0x36
mov al, 0x30
mov byte [esp + 0xe], dl
mov byte [esp + 0x12], dl
mov byte [esp + 0xc], al
mov byte [esp + 0xd], al
mov byte [esp + 0x13], al
lea edx, [esp + 8]
lea eax, [esp + 0x24]
mov cl, 0x41
push edx
push eax
mov byte [esp + 0x10], cl
mov byte [esp + 0x11], 0x54
mov byte [esp + 0x12], 0x4c
mov byte [esp + 0x13], 0x3a
mov byte [esp + 0x17], cl
mov byte [esp + 0x18], 0x39
mov byte [esp + 0x19], cl
mov byte [esp + 0x1c], 0
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x40406d
mov dword [esi + 8], edi
pop edi
pop esi
add esp, 0x80
ret 4
mov cl, 0x65
mov dl, 0x74
mov byte [esp + 0xb], cl
mov byte [esp + 0xe], cl
mov byte [esp + 0x17], cl
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1e], cl
mov byte [esp + 0xa], dl
mov byte [esp + 0xf], dl
lea ecx, [esp + 8]
lea edx, [esp + 0x24]
mov al, 0x72
push ecx
push edx
mov byte [esp + 0x10], 0x49
mov byte [esp + 0x11], 0x6e
mov byte [esp + 0x14], al
mov byte [esp + 0x15], 0x6e
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], 0x45
mov byte [esp + 0x1a], 0x78
mov byte [esp + 0x1b], 0x70
mov byte [esp + 0x1c], 0x6c
mov byte [esp + 0x1d], 0x6f
mov byte [esp + 0x1e], al
mov byte [esp + 0x20], al
mov byte [esp + 0x21], 0x5f
mov byte [esp + 0x22], 0x53
mov byte [esp + 0x24], al
mov byte [esp + 0x25], 0x76
mov byte [esp + 0x27], al
mov byte [esp + 0x28], 0
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x40406d
mov dword [esi + 4], edi
pop edi
pop esi
add esp, 0x80
ret 4
pop edi
mov eax, 1
pop esi
add esp, 0x80
ret 4
Function at 0x404ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x5c
push ebx
push esi
mov esi, ecx
lea eax, [esp + 0x28]
mov bl, 0x65
push eax
mov ecx, dword [esi + 0x174]
mov byte [esp + 0x2c], 0x49
push ecx
mov byte [esp + 0x31], 0x6e
mov byte [esp + 0x32], 0x74
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], 0x72
mov byte [esp + 0x35], 0x6e
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], 0x74
mov byte [esp + 0x38], 0x4f
mov byte [esp + 0x39], 0x70
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x55
mov byte [esp + 0x3d], 0x72
mov byte [esp + 0x3e], 0x6c
mov byte [esp + 0x3f], 0x41
mov byte [esp + 0x40], 0
call dword [esi + 0x1ec]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x174]
lea edx, [esp + 8]
mov byte [esp + 8], 0x49
push edx
push eax
mov byte [esp + 0x11], 0x6e
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], 0x72
mov byte [esp + 0x15], 0x6e
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x4f
mov byte [esp + 0x19], 0x70
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], 0x41
mov byte [esp + 0x1d], 0
call dword [esi + 0x1ec]
mov edx, dword [esi + 0x174]
lea ecx, [esp + 0x3c]
push ecx
push edx
mov dword [esi], eax
mov byte [esp + 0x44], 0x49
mov byte [esp + 0x45], 0x6e
mov byte [esp + 0x46], 0x74
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], 0x72
mov byte [esp + 0x49], 0x6e
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], 0x74
mov byte [esp + 0x4c], 0x52
mov byte [esp + 0x4d], bl
mov byte [esp + 0x4e], 0x61
mov byte [esp + 0x4f], 0x64
mov byte [esp + 0x50], 0x46
mov byte [esp + 0x51], 0x69
mov byte [esp + 0x52], 0x6c
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], 0
call dword [esi + 0x1ec]
mov dword [esi + 8], eax
mov byte [esp + 0x50], 0x49
mov byte [esp + 0x51], 0x6e
mov byte [esp + 0x52], 0x74
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], 0x72
mov byte [esp + 0x55], 0x6e
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], 0x74
mov byte [esp + 0x58], 0x43
mov byte [esp + 0x59], 0x6c
mov byte [esp + 0x5a], 0x6f
mov ecx, dword [esi + 0x174]
lea eax, [esp + 0x50]
push eax
push ecx
mov byte [esp + 0x63], 0x73
mov byte [esp + 0x64], bl
mov byte [esp + 0x65], 0x48
mov byte [esp + 0x66], 0x61
mov byte [esp + 0x67], 0x6e
mov byte [esp + 0x68], 0x64
mov byte [esp + 0x69], 0x6c
mov byte [esp + 0x6a], bl
mov byte [esp + 0x6b], 0
call dword [esi + 0x1ec]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x174]
lea edx, [esp + 0x18]
mov byte [esp + 0x18], 0x48
push edx
push eax
mov byte [esp + 0x21], 0x74
mov byte [esp + 0x22], 0x74
mov byte [esp + 0x23], 0x70
mov byte [esp + 0x24], 0x51
mov byte [esp + 0x25], 0x75
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 0x72
mov byte [esp + 0x28], 0x79
mov byte [esp + 0x29], 0x49
mov byte [esp + 0x2a], 0x6e
mov byte [esp + 0x2b], 0x66
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], 0x41
mov byte [esp + 0x2e], 0
call dword [esi + 0x1ec]
mov dword [esi + 0x10], eax
pop esi
mov eax, 1
pop ebx
add esp, 0x5c
ret
Function at 0x404cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov al, 0x74
mov cl, 0x65
mov byte [esp + 6], al
mov byte [esp + 0xb], al
mov byte [esp + 5], cl
mov byte [esp + 0xc], cl
mov ecx, dword [esi + 0x188]
lea eax, [esp + 4]
push eax
push ecx
mov byte [esp + 0xc], 0x47
mov byte [esp + 0xf], 0x41
mov byte [esp + 0x10], 0x64
mov byte [esp + 0x11], 0x61
mov byte [esp + 0x12], 0x70
mov byte [esp + 0x15], 0x72
mov byte [esp + 0x16], 0x73
mov byte [esp + 0x17], 0x49
mov byte [esp + 0x18], 0x6e
mov byte [esp + 0x19], 0x66
mov byte [esp + 0x1a], 0x6f
mov byte [esp + 0x1b], 0
call dword [esi + 0x1ec]
mov dword [esi + 0x14], eax
mov eax, 1
pop esi
add esp, 0x10
ret

Function at 0x404d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov al, 0x69
push esi
mov esi, ecx
mov byte [esp + 9], al
mov byte [esp + 0xd], al
mov al, 0x65
mov cl, 0x46
mov byte [esp + 0xf], al
mov byte [esp + 0x13], al
mov byte [esp + 8], cl
mov byte [esp + 0xc], cl
mov ecx, dword [esi + 0x19c]
lea eax, [esp + 4]
mov dl, 0x61
push eax
push ecx
mov byte [esp + 0xc], 0x50
mov byte [esp + 0xd], dl
mov byte [esp + 0xe], 0x74
mov byte [esp + 0xf], 0x68
mov byte [esp + 0x12], 0x6e
mov byte [esp + 0x13], 0x64
mov byte [esp + 0x16], 0x6c
mov byte [esp + 0x18], 0x4e
mov byte [esp + 0x19], dl
mov byte [esp + 0x1a], 0x6d
mov byte [esp + 0x1c], 0x41
mov byte [esp + 0x1d], 0
call dword [esi + 0x1ec]
mov dword [esi + 0x18], eax
mov eax, 1
pop esi
add esp, 0x14
ret
Function at 0x407ae0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push ecx
push 0x4081f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x41066c]
push 0xc8
call dword [eax + 0x104]
mov eax, 1
ret
Function at 0x408a70
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, ecx
push 0
push 0
push esi
push 0x408800
push 0
push 0
call edi
push 0
push 0
push esi
push 0x408920
push 0
push 0
call edi
push 0
push 0
push esi
push 0x408a50
push 0
push 0
call edi
mov eax, dword [0x41066c]
push 0x1f4
call dword [eax + 0x104]
pop edi
mov eax, 1
pop esi
ret

Function at 0x408fc0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov esi, ecx
push 0
push 0
push esi
push 0x409140
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov eax, dword [0x41066c]
push 0x64
call dword [eax + 0x104]
mov ecx, dword [esi]
mov edx, dword [0x41066c]
push ecx
call dword [edx + 0x60]
test eax, eax
je 0x40902a
mov eax, dword [esi]
mov ecx, dword [0x41066c]
push esi
push 0x408ee0
push eax
call dword [ecx + 0x6c]
mov edx, dword [0x41066c]
push 0x3e8
call dword [edx + 0x104]
mov eax, dword [esi]
mov ecx, dword [0x41066c]
push eax
call dword [ecx + 0x60]
test eax, eax
jne 0x408ff7
mov edx, dword [0x41066c]
push 0
push edi
call dword [edx + 0xc0]
pop edi
mov eax, 1
pop esi
ret

Function at 0x409820
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x410670]
mov edx, dword [0x41066c]
push esi
mov esi, ecx
mov ecx, dword [eax + 4]
push edi
push ecx
call dword [edx + 0x78]
mov edi, dword [esp + 0x10]
mov ecx, esi
push edi
call fcn.00408ad0
test eax, eax
jne 0x40984d
pop edi
pop esi
pop ecx
ret 4
mov ecx, esi
call fcn.00409320
mov ecx, esi
call fcn.00409460
mov ecx, esi
call fcn.00409700
test eax, eax
je 0x40986e
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
mov ecx, dword [esi + 0x128]
mov edx, dword [esi + 0x108]
lea eax, [esi + 4]
push eax
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x41066c]
push 0
push str.dend
push eax
call dword [ecx + 0x108]
test eax, eax
mov dword [esp + 8], 0xffffffff
je 0x4098cc
mov ecx, dword [0x410670]
lea edx, [esp + 8]
push edx
push 1
push edi
call fcn.0040c8d0
mov eax, dword [esp + 8]
mov ecx, dword [0x41066c]
push 0x124f80
push eax
call dword [ecx + 0xc4]
jmp 0x4098dc
mov ecx, dword [0x410670]
push 0
push 0
push edi
call fcn.0040c8d0
mov ecx, esi
call fcn.00408b90
push 0
push 0
push esi
push 0x409310
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [0x41066c]
push 0x64
mov edi, eax
call dword [edx + 0x104]
mov ecx, esi
call fcn.00408be0
test eax, eax
je 0x409919
mov ecx, esi
call fcn.00408fc0
mov eax, dword [0x41066c]
push 0
push edi
call dword [eax + 0xc0]
pop edi
mov eax, 1
pop esi
pop ecx
ret 4

Function at 0x40a250
Capabilities:
Accept command line arguments

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x40fddc
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
neg eax
sbb eax, eax
inc eax
ret