joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e591
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi]
or eax, dword [edi + 4]
je 0x1001e5e4
mov ecx, 8
mov esi, 0x13cee4d1
sub ebx, ebx
sub eax, eax
mov al, byte [edi]
inc edi
mul esi
rol ebx, 5
xor ebx, eax
dec ecx
jne 0x1001e5ad
test ebx, ebx
jne 0x1001e5c2
mov ebx, esi
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
shr ecx, 2
je 0x1001e5d5
xor dword [edi], ebx
add edi, 4
dec ecx
jne 0x1001e5cd
mov ecx, dword [ebp + 0x10]
and cl, 3
je 0x1001e5e4
xor byte [edi], bl
inc edi
dec cl
jne 0x1001e5dd
pop ebx
pop edi
pop esi
leave
ret

Function at 0x10024360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, 0x5e9212fc
mov edx, 0xa761f0f7
sub eax, eax
mov esi, dword [ebp + 0xc]
lea edi, [esi - 1]
inc edi
cmp byte [edi], 0
jne 0x10024378
cmp esi, edi
je 0x100243a1
mov al, byte [esi]
inc esi
imul ecx, eax, 0x71b2c107
ror edx, 6
xor ecx, edx
imul edx, eax, 0xebae624d
ror ebx, 7
xor edx, ebx
mov ebx, ecx
cmp esi, edi
jb 0x10024382
and ebx, 0x7fffffff
cmp ebx, 0x7fffffab
jb 0x100243b5
sub ebx, 0x7fffffab
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov dword [eax + 4], edx
pop ebx
pop edi
pop esi
leave
ret

Function at 0x1002453a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push ebp
mov ebp, dword [ebp + 8]
mov ebx, dword [ebp + 0x8c]
mov ecx, dword [ebp + 0x94]
test ecx, ecx
je 0x10024580
lea edx, [esi + ecx]
cmp edx, edi
jbe 0x10024563
mov edx, edi
mov al, byte [esi]
xor bl, al
mov byte [esi], bl
ror ebx, 8
dec ecx
inc esi
cmp esi, edx
jb 0x10024563
test ecx, ecx
jne 0x10024629
xor ebx, dword [ebp + 0x90]
mov edx, dword [ebp]
sub edi, 4
jmp 0x100245c9
mov eax, 0x9c4e
mul edx
mov ecx, 0x7fffffab
div ecx
mov ecx, dword [ebp + 4]
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov dword [ebp + 4], ecx
mov eax, dword [ebp + 8]
shr eax, 0x1b
mov ecx, dword [ebp + eax*4 + 0xc]
sub ecx, dword [ebp + 4]
mov dword [ebp + 8], ecx
mov dword [ebp + eax*4 + 0xc], edx
xor ebx, ecx
mov ecx, dword [esi]
xor ebx, ecx
mov dword [esi], ebx
mov ebx, ecx
add esi, 4
cmp esi, edi
jbe 0x10024588
add edi, 4
mov ecx, edi
sub ecx, esi
je 0x10024626
mov eax, 0x9c4e
mul edx
mov ecx, 0x7fffffab
div ecx
mov ecx, dword [ebp + 4]
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov dword [ebp + 4], ecx
mov eax, dword [ebp + 8]
shr eax, 0x1b
mov ecx, dword [ebp + eax*4 + 0xc]
sub ecx, dword [ebp + 4]
mov dword [ebp + 8], ecx
mov dword [ebp + eax*4 + 0xc], edx
xor ebx, ecx
mov dword [ebp + 0x90], ebx
mov ecx, 4
mov al, byte [esi]
xor bl, al
mov byte [esi], bl
ror ebx, 8
dec ecx
inc esi
cmp esi, edi
jb 0x10024617
mov dword [ebp], edx
mov dword [ebp + 0x8c], ebx
mov dword [ebp + 0x94], ecx
pop ebp
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4520d8
Capabilities:
Encode data using xor

Disassembly:
lea edx, [ebx]
pushal
into
add eax, 0x58d2a865
jne 0x4520fe
add byte [eax - 0x639c075a], al
or eax, 0xd7292eb6
or byte [edx + esi*4], 0xf5
ja 0x452088
js 0x452162
cmp ah, byte [eax + 0x3e]
jne 0x4520f0
je 0x452116
mov ebx, 0x5e4de897
movsb byte es:[edi], byte [esi]
mul ebx
cmp edx, esp
xor edi, dword [edx + ecx*4]
mov edx, cs
inc edx
mov dl, 0x3b
mov ah, 0xbc
or al, byte [eax - 0x31]
jno 0x452149
pop edx
not al
clc
paddw mm7, qword [edi + ebp - 0x7737cc58]
push ss
sub ecx, ebp
les ebx, [0xcb796c3f]
invalid
inc ebp
test al, 0x12
jg 0x452151
xor dword [ebx - 0x78f468b6], esp
xchg bl, bh
mov ebx, 0x3dac3de7
dec esi
and dword [edx], edx
add eax, 0xcddce24c
xchg edi, eax
or eax, dword [edi - 0x1844047a]
cmp eax, 0x214e3dac
adc al, byte [0xcddce24c]
int 0x3a
stosb byte es:[edi], al
or eax, 0x9a427250
push esi
outsb dx, byte [esi]
and ch, byte [esi - 0x55]
mov bh, 0xde
imul edx, dword [ebp*8 - 0x6aef72cd], 0x17
push cs
cmp ch, byte [edx + 0x72500df2]
inc edx
lcall 0xb7ab, 0x6e226e56
fisubr word [ebx + 0x14]
in eax, dx
xor ecx, dword [ebp + 0xe179510]
pop ss
clc
cmpxchg dword [esi - 0x74], esp
salc
cmp dword [ecx], edi
adc byte [ebx + 0x13], al
pop ecx
jle 0x45218b
jns 0x4521bc
mov byte [0x3f1564f9], al
sbb al, 0xf3
test eax, 0xb86548b2
mov byte [eax + 0x2ba7ac03], 0x31
in al, 0xf2
or al, 0x77
xor eax, 0x3729b7e
adc eax, edi
sub eax, 0x9d41726a
Function at 0x4593dc
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor dword [edi + esi], eax
aaa
and ebx, dword [ebx - 0x2157e499]
lodsd eax, dword [esi]
mov ch, cl
dec esp
jbe 0x459411
sti
push ecx
fmul dword [edi]
lahf
add eax, 0x78e9de51
push 0xffffffffffffffde
pop ebp
retf
add al, 0x5b
push edi
or byte [esi - 0x7ad7e1a2], al
jl 0x4593b3
or al, 0xdc
add byte [edx], ch
xlatb
fistp qword [edi + 0x1a]
mov bh, 0xff
jg 0x4593b1
xchg ecx, eax
pop es
dec esp
in al, dx
daa
mov fs, word [edx]
pop esi
loopne 0x45944b
push es
sub ebx, 0x66
mov word ds:[edx + 0x41], es
jne 0x45947e
pop ecx
adc dl, 8
pushfd
xchg ecx, eax
outsb dx, byte [esi]
sbb eax, esi
and dword [0xacefcd99], edi
pop edi
push cs
push esi
insd dword es:[edi], dx
adc byte [ebp + 0x1d], ah
inc ebp
xchg bx, ax
push edx
sbb eax, 0x52936645
inc ecx
mov ebp, gs
pop eax
xor ah, byte [ebx + 0x7f3095fa]
pushal
not dword ds:[edx - 0x45e74bbe]
mov al, byte [0x3ce2]
rcl dword [ecx], 0x20
mov eax, 0x9ee0d7fc
loopne 0x4593de
out 0x6f, al
jmp 0x856fa8f
xchg byte [ebp - 0x7dac010], cl
rol bh, 1
add dword [ebp + 0x1402cea5], 0x7f
jle 0x459477
mov dword [ecx], esi
adc al, 0xe3
cmp byte [ebp + edi*4 - 0x787ee298], bl
cwde
push 0xf0b37384
outsd dx, dword [esi]
pop ebx
jnp 0x4594db
mov ecx, 0x2adc2a8d
xchg dword [esi], ebp
shr dword [edi - 0x1d], cl
shr dword cs:[edi - 0x1d], cl
outsd dx, dword [esi]
add bh, byte [eax - 0x10]
scasb al, byte es:[edi]
pop esp
mov word [edx + 0x5311f388], ss
stosb byte es:[edi], al
out dx, eax
das
invalid
jle 0x45941c
out dx, al
invalid
inc edx
mov ah, 0xa9
pop edi
cmp byte [esi - 0x4ab22968], al
jmp 0xc11b6d77
xor esp, dword [edx + 0x6ae680fd]
inc esp
mov bh, 0xae
jo 0x459503
call 0x62615060
add dword [ebx + ebx*2 - 0x610c3843], 0xa99798b3
dec dword [ebp + 0x72]
call 0x8ffe1e9a
test eax, 0xe8724dff
mov dh, 0x89
mov eax, 0xa379f38f
jns 0x45948a
test edx, ecx
cmp dword [eax + esi - 0x31], ebp
jns 0x45949e
jns 0x4594c1
jne 0x4594e4
fcmovbe st(0), st(6)
invalid
rol dword [ebp - 0x1d], cl
invalid
Function at 0x45943e
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor dword [edi + esi], eax
aaa
and ebx, dword [ebx - 0x2157e499]
lodsd eax, dword [esi]
mov ch, cl
dec esp
jbe 0x459411
sti
push ecx
fmul dword [edi]
lahf
add eax, 0x78e9de51
push 0xffffffffffffffde
pop ebp
retf
add al, 0x5b
push edi
or byte [esi - 0x7ad7e1a2], al
jl 0x4593b3
or al, 0xdc
add byte [edx], ch
xlatb
fistp qword [edi + 0x1a]
mov bh, 0xff
jg 0x4593b1
xchg ecx, eax
pop es
dec esp
in al, dx
daa
mov fs, word [edx]
pop esi
loopne 0x45944b
push es
sub ebx, 0x66
mov word ds:[edx + 0x41], es
jne 0x45947e
pop ecx
adc dl, 8
pushfd
xchg ecx, eax
outsb dx, byte [esi]
sbb eax, esi
and dword [0xacefcd99], edi
pop edi
push cs
push esi
insd dword es:[edi], dx
adc byte [ebp + 0x1d], ah
inc ebp
xchg bx, ax
push edx
sbb eax, 0x52936645
inc ecx
mov ebp, gs
pop eax
xor ah, byte [ebx + 0x7f3095fa]
pushal
not dword ds:[edx - 0x45e74bbe]
mov al, byte [0x3ce2]
rcl dword [ecx], 0x20
mov eax, 0x9ee0d7fc
loopne 0x4593de
out 0x6f, al
jmp 0x856fa8f
xchg byte [ebp - 0x7dac010], cl
rol bh, 1
add dword [ebp + 0x1402cea5], 0x7f
jle 0x459477
mov dword [ecx], esi
adc al, 0xe3
cmp byte [ebp + edi*4 - 0x787ee298], bl
cwde
push 0xf0b37384
outsd dx, dword [esi]
pop ebx
jnp 0x4594db
mov ecx, 0x2adc2a8d
xchg dword [esi], ebp
shr dword [edi - 0x1d], cl
shr dword cs:[edi - 0x1d], cl
outsd dx, dword [esi]
add bh, byte [eax - 0x10]
scasb al, byte es:[edi]
pop esp
mov word [edx + 0x5311f388], ss
stosb byte es:[edi], al
out dx, eax
das
invalid
jle 0x45941c
out dx, al
invalid
inc edx
mov ah, 0xa9
pop edi
cmp byte [esi - 0x4ab22968], al
jmp 0xc11b6d77
xor esp, dword [edx + 0x6ae680fd]
inc esp
mov bh, 0xae
jo 0x459503
call 0x62615060
add dword [ebx + ebx*2 - 0x610c3843], 0xa99798b3
dec dword [ebp + 0x72]
call 0x8ffe1e9a
test eax, 0xe8724dff
mov dh, 0x89
mov eax, 0xa379f38f
jns 0x45948a
test edx, ecx
cmp dword [eax + esi - 0x31], ebp
jns 0x45949e
jns 0x4594c1
jne 0x4594e4
fcmovbe st(0), st(6)
invalid
rol dword [ebp - 0x1d], cl
invalid

Function at 0x484b01
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x832f311e
cmc
movsd dword es:[edi], dword [esi]
cwde
invalid

Function at 0x48ab75
Capabilities:
Encode data using xor

Disassembly:
int 0x8d
jae 0x48ab42
jge 0x48ab15
in al, dx
ffreep st(4)
add dword [ebp - 0x2f], eax
jge 0x48ab15
xchg edx, esi
lahf
pushfd
xchg edi, eax
add esi, esi
pop eax
sub dword [esi], edx
and al, 0xbf
add eax, 0x5383a95d
ret
add edx, ecx
mov bl, byte [esi + 0x68533911]
mov eax, dword [0x3815c06b]
inc ecx
dec ecx
enter 0xffffffffffff9b19, 0xffffffffffffffa5
mov ch, 0x93
add eax, 0x391d32e7
stc
cmp ecx, ecx
xchg dword [edx], esp
mov edi, 0x57c17fed
imul byte [edi - 0x49fe0de5]
imul eax, dword [eax - 0x62], 0x8df74bd6
int3
jp 0x48ab04
jae 0x48ab81
mov byte [0xf633842a], al
or dword [ebx - 9], edx
mov ebx, 0xc098aed5
Function at 0x6248de
Capabilities:
Encode data using xor

Disassembly:
pop edx
mov al, 0xe3
cwde
int 0x24
pop dword [ebx + 0x77fff44a]
test eax, 0x886db47
test byte [eax - 0x13], al
xor dword [ebx - 0x40], 0x986df12d
aad 0x43
pop esp
cmc
pushfd
mov eax, 0x14056dda
adc byte [esi + 0x67], ah
cmp dword [eax + 0x4e], 0x4bd81c9c
jns 0x6248ca
add ch, al
insb byte es:[edi], dx
mov dword [0x2e192222], eax
mov ebx, 0x43184a1a
mul dword [eax + 0xc87325b]
xor eax, 0x6e2b8a11
sub cl, ah
jl 0x6248fc
test eax, 0x1e3d566e
shl byte [eax], cl
scasd eax, dword es:[edi]
sbb eax, 0x7edd9bed
cmc
or dl, dl
cli
les ebp, [ebp + 0x8dcfb0f]
sbb al, 0x87
xor dword [eax], edi
inc edi
xor eax, 0x5ca75004
mov cl, byte [ebx - 0x73b4b091]
call 0xce807965
into
jae 0x6249aa
arpl word [edi], si
wait
mov ebp, 0x403fb045
and eax, 0xc0d627d5
rol byte [eax + 0x80b4f32], 1
mov byte [0x3b1e2916], al
loope 0x624943
inc esi
add al, 0x33
pop ecx
leave
sal byte [edx], 1
retf
dec ebx
sbb eax, 0x16dd9b6b
adc bl, bl
invalid

Function at 0x6295c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6343f0
cmp edx, dword [eax]
je 0x6295e3
add eax, 8
inc ecx
cmp eax, 0x634480
jl 0x6295d4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6343f0]
jne 0x629711
mov eax, dword [0x63cd98]
cmp eax, 1
je 0x6296eb
test eax, eax
jne 0x629614
cmp dword [0x634318], 1
je 0x6296eb
cmp edx, 0xfc
je 0x629711
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62964b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629fa0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a430
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62968e
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a430
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62eecc
push edi
call fcn.0062c300
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629fa0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629fb0
lea eax, [ebp - 0xa0]
push 0x62eeac
push eax
call fcn.00629fb0
lea eax, [ebp + 8]
lea esi, [esi + 0x6343f4]
push 0
push eax
push dword [esi]
call fcn.0062a430
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x404100
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48604c], 0
je 0x404161
cmp word [0x486220], 0xd7b2
jne 0x404129
cmp dword [0x486228], 0
jbe 0x404129
mov eax, 0x48621c
call dword [0x486238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x484054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404188
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48401c], 0
jne 0x40417d
push 0
push 0x484074
push 0x484054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4067ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.00406551
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00406506
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40682f
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00406541
mov byte [edi], bl
rol esp, 0x8d
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x406998
Capabilities:
Contain obfuscated stackstrings

Disassembly:
loop 0x4069ec
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00406551
push eax
push esi
push dword [ebp + 8]
call fcn.00406506
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00406541
invalid
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00406541
ljmp 0x7c85

Function at 0x406a9c
Capabilities:
Inspect section memory permissions

Disassembly:
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
mov esp, 0xff80048d
je 0x406a4c
adc byte [ebp + 0x488bc104], cl
adc al, 0x8b
inc eax
or al, 3
dec ebp
adc byte [ebx], al
invalid
push ecx
push eax
call fcn.004064b2
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x406a7e
call fcn.00406541
invalid

Function at 0x406b24
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ebp + 0x10], edi
jmp 0x406b2e
call fcn.00406541
or byte [edx + 0x458b82ee], ch
stosb byte es:[edi], al
out dx, al
or byte [ebx + 0x8b1045], 0x3b
cmp eax, ebx
je 0x406b77
invalid
add byte [eax], al
invalid

Function at 0x406b2c
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x406ae6
cmp dword [eax + 0xc], ebx
je 0x406b89
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.00406541
lcall 0xc5d, 0x399e2b4f
jne 0x406b15
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x406d30
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
add byte [ebx], bh
ret
lea edi, [ecx + esi]
jne 0x406b29
add eax, esi
mov dword [ebp + 0x10], eax
inc ebp
invalid
cmp eax, ebx
je 0x406b77
Function at 0x406b34
Capabilities:
Inspect section memory permissions

Disassembly:
stosb byte es:[edi], al
out dx, al
or byte [ebx + 0x8b1045], 0x3b
cmp eax, ebx

Function at 0x406b3c
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x406ae6
cmp dword [eax + 0xc], ebx
je 0x406b89
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.00406541
lcall 0xc5d, 0x399e2b4f
jne 0x406b15
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x406d30
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
add byte [ebx], bh
ret
lea edi, [ecx + esi]
jne 0x406b29
add eax, esi
mov dword [ebp + 0x10], eax
inc ebp
invalid
cmp eax, ebx
je 0x406b77

Function at 0x406ba4
Capabilities:
Inspect section memory permissions

Disassembly:
add al, 0x8d
dec eax
or byte [ebx], al
ror byte [ecx - 0x35c4f7b3], 1
or byte [ebx], bh
invalid

Function at 0x406bcc
Capabilities:
Inspect section memory permissions

Disassembly:
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
lock add byte [eax], al
cmp edx, 0x3000
jne 0x406bda
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
cmp edx, ebx

Function at 0x406bdc
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x406bf5
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
or byte [ebx], bh
invalid
jae 0x406bf0
mov ecx, dword [ebp + 8]
jne 0x406d30
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
dec ebp
or byte [edx - 0x3f], dh
add eax, dword [eax + 4]
jmp 0x406b9e
invalid
mov dword [ebp + 0xc], ebx
jmp 0x406c00
invalid
invalid
invalid
invalid

Function at 0x406bfc
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
cmp eax, dword [edi + 6]
jne 0x406c18
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x406c36
movzx eax, ax
lea eax, [eax + eax*4]
add al, 0x80
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edx + ecx - 1]
xor edx, edx
inc dword [ebp + 0xc]
invalid
test dword [eax - 1], edi
invalid

Function at 0x406c2c
Capabilities:
Inspect section memory permissions

Disassembly:
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
js 0x406c5a

Function at 0x406c44
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
invalid
invalid
invalid
cmp eax, dword [ebp - 0x44]
ja fcn.00406c94

Function at 0x406c54
Capabilities:
Inspect section memory permissions

Disassembly:
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax], al
invalid
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
add byte [eax], al
invalid
invalid

Function at 0x406c6c
Capabilities:
Inspect section memory permissions

Disassembly:
loop 0x406c66
add byte [eax], al
and byte [ecx + 0x1065], al
add byte [eax], al
add byte [eax + 0x3b184d8b], al
Function at 0x406c74
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x406c7b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je fcn.00406c84
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
cmp dword [ebp + 0x10], ebx
je 0x406c8e
add ecx, eax
or byte [ecx], 4
invalid
invalid
or byte [eax + ecx], 2
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x406c70

Function at 0x406c7c
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x406c7b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je fcn.00406c84
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
cmp dword [ebp + 0x10], ebx
je 0x406c8e
add ecx, eax
or byte [ecx], 4
invalid
invalid
or byte [eax + ecx], 2
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x406c70

Function at 0x406c84
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [ebp + 0x10], ebx
je 0x406c8e
add ecx, eax
or byte [ecx], 4
invalid
invalid

Function at 0x406c8c
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [ebp + 0x10], ebx
je 0x406c8e
add ecx, eax
or byte [ecx], 4
invalid
invalid

Function at 0x406c94
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
cmp eax, dword [edi + 6]
jne 0x406c18
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x406c36
movzx eax, ax
lea eax, [eax + eax*4]
add al, 0x80
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edx + ecx - 1]
xor edx, edx
inc dword [ebp + 0xc]
invalid
test dword [eax - 1], edi
invalid

Function at 0x406d7c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax - 0x3a]
test dword [edx + 0x51fffffc], esi
push ecx
mov byte [ebp - 0x34d], 0x75

Function at 0x406e24
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
invalid
inc dword [eax + eax]
add byte [eax], al

Function at 0x407164
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x512], 0xe3
jecxz 0x4070ee
movsd dword es:[edi], dword [esi]
out dx, eax
cli
invalid
inc dword [eax]

Function at 0x424688
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42468e
ret
Function at 0x43681c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4369cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404934
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4369e4
call fcn.00404598
mov eax, ebx
call fcn.0042269c
mov edi, eax
dec edi
test edi, edi
jl 0x4368d4
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00422670
mov edx, dword [0x42fcd4]
call fcn.00403680
test al, al
je 0x4368d0
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00422670
lea edx, [ebp - 0x14]
call fcn.0043ef40
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404934
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040460c
inc esi
dec edi
jne 0x436882
mov al, byte [0x4369e8]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4369f4
mov eax, dword [ebp - 0xc]
call fcn.0040cb20
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.0040431c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0043ef40
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4369e4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f0]
call fcn.0043ef40
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4369e4
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4369e4
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x436a00
call fcn.004098b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4369d4
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004042a8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004042a8
lea eax, [ebp - 0x14]
call fcn.00404284
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004042a8
ret