joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418a00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
cmp dword [ebp + 0xc], 0x104
jae 0x418a25
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov byte [edx + ecx], 0
jmp 0x418b7a
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jge 0x418a4f
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov byte [eax + edx], 0
jmp 0x418b7a
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 1], cl
add dword [ebp - 0xc], 1
cmp byte [ebp - 1], 0
jne 0x418a5e
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [ebp - 2], cl
add dword [ebp - 0x10], 1
cmp byte [ebp - 2], 0
jne 0x418a8e
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
lea edx, [ecx + eax + 2]
cmp edx, dword [ebp + 0xc]
jbe 0x418acc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov byte [edx + ecx], 0
jmp 0x418b7a
mov eax, dword [ebp + 8]
add eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dl, byte [ecx + 1]
mov byte [ebp - 3], dl
add dword [ebp - 0x18], 1
cmp byte [ebp - 3], 0
jne 0x418ad5
mov edi, dword [ebp - 0x18]
mov ax, word [0x581800]
mov word [edi], ax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x14]
mov cl, byte [eax]
mov byte [ebp - 4], cl
add dword [ebp - 0x14], 1
cmp byte [ebp - 4], 0
jne 0x418b00
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], edx
mov ecx, dword [ebp + 8]
add ecx, 0xffffffff
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov al, byte [edx + 1]
mov byte [ebp - 5], al
add dword [ebp - 0x1c], 1
cmp byte [ebp - 5], 0
jne 0x418b2a
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 8]
add eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dl, byte [ecx + 1]
mov byte [ebp - 6], dl
add dword [ebp - 0x20], 1
cmp byte [ebp - 6], 0
jne 0x418b5d
mov edi, dword [ebp - 0x20]
mov al, byte [0x581156]
mov byte [edi], al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x418d80
Capabilities:
Check if file exists
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524618
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x592bb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.004071b0
push eax
call fcn.00405510
add esp, 4
movzx eax, al
test eax, eax
je 0x418dd1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
call fcn.004184d0
add esp, 4
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
lea ecx, [ebp + 0xc]
call fcn.004071b0
push eax
call fcn.00405510
add esp, 4
movzx edx, al
test edx, edx
je 0x418e2a
push 0
call fcn.004184d0
add esp, 4
sub eax, dword [ebp - 0x64]
sbb edx, dword [ebp - 0x60]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], edx
cmp dword [ebp - 0x68], 0
jg 0x418e2a
jl 0x418e1d
cmp dword [ebp - 0x6c], 0xa
jae 0x418e2a
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x418de1
lea ecx, [ebp + 0xc]
call fcn.004071b0
push eax
call fcn.00405510
add esp, 4
movzx eax, al
test eax, eax
je 0x418ecf
push 0
push 0
lea ecx, [ebp + 0xc]
call fcn.004071b0
push eax
call fcn.00405320
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x418ecf
lea ecx, [ebp + 0xc]
call fcn.004071b0
push eax
call fcn.00405510
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x418ecf
lea edx, [ebp + 0xc]
push edx
push str.CANNOT_KILL_APP:
lea eax, [ebp - 0x58]
push eax
call fcn.0040e0b0
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.004071b0
push eax
call fcn.00418b80
add esp, 4
mov byte [ebp - 0x59], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00407540
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00407540
mov al, byte [ebp - 0x59]
jmp 0x418f7a
lea ecx, [ebp - 0x40]
push ecx
call fcn.00403830
add esp, 4
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x70], esp
lea edx, [ebp + 0xc]
push edx
call fcn.004078a0
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.004036b0
add esp, 0x20
mov dword [ebp - 0x78], eax
lea ecx, [ebp - 0x28]
call fcn.004071b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x418f45
mov byte [ebp - 0x5a], 1
lea ecx, [ebp - 0x28]
call fcn.00407540
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00407540
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00407540
mov al, byte [ebp - 0x5a]
jmp 0x418f7a
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x5b], 1
lea ecx, [ebp - 0x28]
call fcn.00407540
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00407540
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00407540
mov al, byte [ebp - 0x5b]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6445
mov esp, ebp
pop ebp
ret
Function at 0x41a1d0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x592bb4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp + 8]
jge 0x41a32e
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x108], 0
cmp dword [ebp - 0x20c], 0x40
jae 0x41a238
mov ecx, dword [ebp - 0x20c]
mov edx, dword [ebp + 0x14]
mov dword [ebp + ecx*4 - 0x208], edx
mov eax, dword [ebp - 0x20c]
add eax, 1
mov dword [ebp - 0x20c], eax
xor ecx, ecx
jne 0x41a210
cmp dword [ebp - 0x108], 0x40
jae 0x41a264
mov edx, dword [ebp - 0x108]
mov eax, dword [ebp + 0x14]
mov dword [ebp + edx*4 - 0x104], eax
mov ecx, dword [ebp - 0x108]
add ecx, 1
mov dword [ebp - 0x108], ecx
xor edx, edx
jne 0x41a23c
mov dword [ebp - 0x218], 0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x108]
push edx
push 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 0x14]
add ecx, 1
push ecx
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jg 0x41a2b2
xor eax, eax
jmp 0x41a32e
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x41a2cb
xor eax, eax
jmp 0x41a32e
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x41a2e4
xor eax, eax
jmp 0x41a32e
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.0041d4d0
add esp, 0xc
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jg 0x41a317
xor eax, eax
jmp 0x41a32e
mov eax, dword [ebp - 0x210]
add eax, dword [ebp - 0x214]
mov dword [ebp - 0x210], eax
jmp 0x41a1ed
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e6445
mov esp, ebp
pop ebp
ret
Function at 0x4434a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor dl, dl
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x4434c6
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x4434b6
pop edi
movzx eax, dl
pop esi
ret

Function at 0x459b90
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.00496410
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.004feae0
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x459c47
push 0x4a
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00445fd0
push 0x5270e8
push esi
push 0x5826d4
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.004457c0
add esp, 0x2c
call fcn.00509161
cmp dword [eax], 2
je 0x459c29
call fcn.00509161
cmp dword [eax], 6
je 0x459c29
push 0x53
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00445fd0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x51
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00445fd0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x5425a8
call fcn.00444180
mov esi, eax
add esp, 4
test esi, esi
jne 0x459c69
push edi
call fcn.00505227
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.00443d80
push edi
push ebx
push 0x6a
push esi
call fcn.00443db0
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x479330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ebp
push edi
sub ecx, 4
jb 0x479361
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x479368
add edx, 4
add esi, 4
sub ecx, 4
jae 0x479350
xor edi, edi
cmp ecx, 0xfffffffc
je 0x4793a3
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x4793a3
cmp ecx, 0xfffffffd
je 0x4793a3
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x4793a3
cmp ecx, 0xfffffffe
je 0x4793a3
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x4793a3
cmp ecx, 0xffffffff
je 0x4793a3
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle 0x4793be
push 0x157
push str.....openssl_1.1.0fcryptox509v3_v3_addr.c
push str.assertion_failed:_memcmp_min__max__length____0
call fcn.004434d0
add esp, 0xc
mov edi, dword [esp + 0x14]
xor ecx, ecx
test ebx, ebx
jle 0x4793dd
mov esi, edi
mov edx, ebp
sub esi, ebp
nop
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x4793dd
inc ecx
inc edx
cmp ecx, ebx
jl 0x4793d0
lea edx, [ebx - 1]
test edx, edx
js 0x479401
mov esi, edi
lea eax, [edx + ebp]
sub esi, ebp
nop dword [eax + eax]
cmp byte [eax + esi], 0
jne 0x479401
cmp byte [eax], 0xff
jne 0x479401
dec eax
sub edx, 1
jns 0x4793f0
cmp ecx, edx
jl case.0x47942d.2
jle 0x479413
pop edi
pop esi
pop ebp
lea eax, [ecx*8]
pop ebx
ret
mov bl, byte [ecx + ebp]
mov dh, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x47942d.2
movzx eax, byte [eax + 0x4794a0]
jmp dword [eax*4 + 0x479480]
mov eax, 7
jmp 0x479463
mov eax, 6
jmp 0x479463
mov eax, 5
jmp 0x479463
mov eax, 4
jmp 0x479463
mov eax, 3
jmp 0x479463
mov eax, 2
jmp 0x479463
mov eax, 1
test dl, dh
jne case.0x47942d.2
and bl, dl
cmp bl, dl
jne case.0x47942d.2
pop edi
pop esi
pop ebp
lea eax, [eax + ecx*8]
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x496160
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x49624c
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
inc edi
nop word [eax + eax]
cmp esi, 3
jl 0x4961dd
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + 0x552f20]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x552f20]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x552f20]
mov byte [edx + 2], al
add edx, 3
and ecx, 0x3f
movzx eax, byte [ecx + 0x552f20]
mov byte [edx], al
jmp 0x496231
movzx eax, byte [edi - 1]
shl eax, 0x10
cmp esi, 2
jne 0x4961f1
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + 0x552f20]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x552f20]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x49621b
lea eax, [esi + 0x3c]
jmp 0x496228
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x552f20]
mov byte [edx + 2], al
add edx, 3
mov byte [edx], 0x3d
sub esi, 3
add ebx, 4
add edi, 3
inc edx
test esi, esi
jg 0x496180
pop edi
pop esi
mov eax, ebx
mov byte [edx], 0
pop ebx
ret
mov eax, dword [esp + 0xc]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
ret
Function at 0x4b4270
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
mov eax, 0x6c
call fcn.004e6bd0
mov eax, dword [0x592bb4]
xor eax, esp
mov dword [esp + 0x68], eax
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4b42e6
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4b42da
mov eax, 8
call fcn.004e6bd0
movsd xmm0, qword [0x559c30]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.0044f160
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4b434a
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4b433e
mov eax, 8
call fcn.004e6bd0
movsd xmm0, qword [0x559c30]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.0044f160
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call fcn.004b43d0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 8
call fcn.004e6bd0
movsd xmm0, qword [0x5827f0]
lea eax, [esp + 0x10]
movsd qword [esp], xmm0
push 0x20
push eax
call fcn.0044f160
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
mov eax, 8
call fcn.004e6bd0
movsd xmm0, qword [0x5827f0]
lea eax, [esp + 0xc]
movsd qword [esp], xmm0
push 4
push eax
call fcn.0044f160
mov ecx, dword [esp + 0x78]
add esp, 0x10
xor ecx, esp
mov eax, 1
call fcn.004e6445
add esp, 0x6c
ret

Function at 0x4e9335
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x50a83d
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0050a700
Function at 0x512a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.005127e5
push eax
nop
mov dword [0x50a8458d], eax
call fcn.005127f5
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.005127aa
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x512ad3
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a

Function at 0x512b9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.005127f5
call dword [eax + 0x56]

Function at 0x512bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.005127aa
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.005127f5
push eax
push esi
push dword [ebp + 8]
call fcn.005127aa
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.005127e5
fist word [ecx + 0x7c9d887c]
invalid
Function at 0x5147ce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [ebp + eax - 0x17], dh
mov ch, 0
add byte [eax], al
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x51482f
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x514834
jmp 0x514187
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x51487b
lea eax, [ebp - 0x714]
push eax
call fcn.005127f5
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.005127aa
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x514886
jmp 0x51488b
jmp 0x514187
cmp dword [ebp - 0x37c], 0
jne 0x514935
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.005129c1
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x514921
lea eax, [ebp - 0x714]
push eax
call fcn.005127f5
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.0051288a
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5162ff
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051617e

Function at 0x51bde9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051baa9
Function at 0x100051aa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x100051b4
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x100051a5
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
inc ebp
mov bh, 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.10004f60
push 0x8d77a4b3

Function at 0x100057b9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.10004f70
pop ecx
Function at 0x401180
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4041c0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x3c
mov eax, dword [0x407024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
call fcn.00401330
add esp, 4
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call fcn.004025d0
add esp, 8
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push 0x405148
lea ecx, [ebp - 0x30]
push ecx
call sub.msvcrt.dll_strcat
add esp, 8
push 0x405154
lea edx, [ebp - 0x30]
push edx
call sub.msvcrt.dll_strcat
add esp, 8
push 0x40515c
lea eax, [ebp - 0x30]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x34]
push edx
call fcn.004023b0
add esp, 8
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.004023b0
add esp, 8
mov dword [ebp - 0x40], eax
lea edx, [ebp - 0x4c]
push edx
push 0
push 0
mov eax, dword [ebp - 0x40]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x44], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x401290
mov dword [ebp - 4], 0xffffffff
jmp 0x4012a5
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x34]
push edx
call fcn.004022b0
add esp, 4
cmp dword [ebp - 0x38], 0
je 0x4012ce
mov eax, dword [ebp - 0x38]
push eax
call sub.msvcrt.dll_free
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00403d5b
mov esp, ebp
pop ebp
ret