joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f6ac
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, edx
dec eax
test eax, eax
jb 0x47f6da
inc eax
xor edx, edx
mov dl, byte [ebx]
mov esi, dword [ecx]
and esi, 0xff
xor edx, esi
mov edx, dword [edx*4 + 0x486df0]
mov esi, dword [ecx]
shr esi, 8
xor edx, esi
mov dword [ecx], edx
inc ebx
dec eax
jne 0x47f6b8
pop esi
pop ebx
ret

Function at 0x47f6e0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049f4
xor eax, eax
push ebp
push 0x47f7b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov word [eax], 1
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffff
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404a04
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x47f7a1
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov edi, eax
push 0
push edi
push 0
push 2
push 0
push ebx
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
test esi, esi
je 0x47f79b
push edi
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x47f795
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.0047f6ac
mov eax, dword [ebp - 8]
not dword [eax]
mov eax, dword [ebp + 8]
mov word [eax], 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push esi
call sub.kernel32.dll_CloseHandle_1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f7be
lea eax, [ebp - 4]
call fcn.00404544
ret
Function at 0x480160
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov esi, eax
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, edx
xor eax, eax
push ebp
push 0x4802df
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0x105
mov eax, esi
call fcn.00404544
lea eax, [ebp - 4]
mov edx, 0x4802f8
call fcn.004045dc
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.004800d8
mov eax, dword [ebp - 0x2c]
call fcn.00404a04
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x4802bc
mov eax, dword [ebp - 0x10]
call fcn.0040279c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4802b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x48029c
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x480304
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x480274
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.00407454
movzx eax, ax
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
lea edx, [ebp - 0x48]
mov ecx, 2
mov eax, 0x480328
call fcn.004098bc
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 4]
call fcn.004045dc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a04
push eax
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x48029c
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.004093cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4802bc
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004027bc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4802e6
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00404568
lea eax, [ebp - 4]
call fcn.00404544
ret

Function at 0x4803a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
push ebp
push 0x4803de
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0x4803ec
mov eax, dword [ebp + 8]
push eax
push 0x4803f0
push 0x480400
push 0
call sub.shell32.dll_ShellExecuteA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4803e5
ret
Function at 0x480408
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
push ebp
push 0x480446
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0x480454
mov eax, dword [ebp + 8]
push eax
push 0x480458
push 0x480468
push 0
call sub.shell32.dll_ShellExecuteA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48044d
ret

Function at 0x48065c
Capabilities:
Create process on windows

Disassembly:
push ebx
push 0
push 0x48067c
call sub.kernel32.dll_WinExec
push 0
push 0x480690
call sub.kernel32.dll_WinExec
mov eax, ebx
pop ebx
ret

Function at 0x4806b0
Capabilities:
Create process on windows

Disassembly:
push ebx
push 0
push 0x4806c4
call sub.kernel32.dll_WinExec
mov eax, ebx
pop ebx
ret

Function at 0x4806d8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
cmp dword [0x489c5c], 0
jle 0x480715
mov eax, dword [0x489c58]
call fcn.0040570c
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x480715
inc ebx
xor esi, esi
mov eax, dword [0x489c58]
mov eax, dword [eax + esi*4]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push 0
push eax
call sub.kernel32.dll_TerminateProcess
inc esi
dec ebx
jne 0x4806f7
mov al, 1
pop esi
pop ebx
ret

Function at 0x483ba4
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov eax, 4
call fcn.0040279c
mov ebx, eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push ebx
push 0
push 0
push 0x483be8
call sub.kernel32.dll_GetVolumeInformationA
mov esi, dword [ebx]
mov edx, 4
mov eax, ebx
call fcn.004027bc
mov eax, esi
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x483bec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x483cc5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x483c88
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x483cd4
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0x10]
call fcn.00407454
movzx eax, ax
lea ecx, [ebp - 0x18]
mov edx, 4
call fcn.00408c40
push dword [ebp - 0x18]
push 0x483ce0
lea ecx, [ebp - 0x1c]
movzx eax, word [ebp - 0x10]
mov edx, 4
call fcn.00408c40
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004048c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x483c9f
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.00404598
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483ccc
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404568
ret
Function at 0x484074
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4840ec
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
call fcn.0040473c
lea eax, [ebp - 8]
mov ecx, 0x484104
mov edx, dword [ebp - 4]
call fcn.00404850
mov eax, dword [ebp - 8]
call fcn.00409068
test al, al
je 0x4840d1
push 3
push 0x48411c
mov eax, dword [ebp - 8]
call fcn.00404a04
push eax
push 0x484120
push 0x48412c
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4840f3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404568
ret

Function at 0x484148
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe20
xor eax, eax
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x484295
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, 0x48726c
call fcn.00480160
mov eax, dword [ebp - 4]
call fcn.00404804
dec eax
jle 0x48426f
mov eax, dword [0x48727c]
mov edx, dword [ebp - 4]
call fcn.00404950
je 0x48426f
lea edx, [ebp - 8]
mov eax, 0x48726c
call fcn.004800d8
mov eax, dword [ebp - 8]
call fcn.00409068
test al, al
je 0x48426f
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 8]
call fcn.0040473c
mov eax, dword [ebp - 0xc]
call fcn.00404804
mov edx, dword [ebp - 0xc]
cmp byte [edx + eax - 1], 0x5c
je 0x4841e9
lea eax, [ebp - 0xc]
mov edx, 0x4842ac
call fcn.0040480c
lea eax, [ebp - 0x10]
mov ecx, 0x4842b8
mov edx, dword [ebp - 0xc]
call fcn.00404850
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x1dc]
call fcn.00402d04
lea eax, [ebp - 0x1dc]
call fcn.00402aa0
call fcn.00402904
push 0x4842e4
push dword [ebp - 8]
push 0x4842fc
lea eax, [ebp - 0x1e0]
mov edx, 3
call fcn.004048c4
mov edx, dword [ebp - 0x1e0]
lea eax, [ebp - 0x1dc]
call fcn.00404c20
call fcn.00403178
call fcn.00402904
lea eax, [ebp - 0x1dc]
call fcn.00402dcc
call fcn.00402904
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404a04
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48429c
lea eax, [ebp - 0x1e0]
call fcn.00404544
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404568
ret
Function at 0x41e810
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422dab
mov eax, dword fs:[0]
push eax
mov eax, 0x123c
call fcn.0041fd70
mov eax, dword [0x42e07c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x210]
push str.FN_CSharedMemoryChannel_GetMessage
push eax
call fcn.00401880
add esp, 8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x423484
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, edi
call fcn.0041e4b0
cmp eax, 0xfffe00ff
jne 0x41e8cc
mov ecx, edi
call fcn.0041e4b0
mov ecx, edi
call fcn.0041e4b0
mov ecx, edi
call fcn.0041e4b0
mov ecx, edi
call fcn.0041e4b0
lea edx, [eax - 1]
cmp edx, 0xffe
ja 0x41e8b2
push eax
lea eax, [ebp - 0x1210]
mov ecx, edi
push eax
call fcn.0041e540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041ecc2
mov esp, ebp
pop ebp
ret
push str.Invalid_Message_Header
lea ecx, [ebp - 0x1228]
call fcn.00402d30
lea eax, [ebp - 0x1228]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x1244]
call fcn.00401b80
push 0x42b38c
lea eax, [ebp - 0x1244]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x41f37b
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x42b2e0
call fcn.0041fa90
push 1
call fcn.0041f03d
pop ecx
test al, al
je 0x41f4d7
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041f00b
mov byte [ebp - 0x24], al
mov eax, dword [0x43222c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x41f4d7
test eax, eax
jne 0x41f405
mov dword [0x43222c], ecx
push 0x423340
push 0x42332c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41f3e8
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41f4d1
push 0x423328
push 0x423314
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x43222c], 2
jmp 0x41f40a
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041f1aa
pop ecx
call fcn.0041fc0d
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41f43b
push esi
call fcn.0041f120
pop ecx
test al, al
je 0x41f43b
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call dword [0x423310]
call esi
call fcn.0041fc13
mov esi, eax
cmp dword [esi], edi
je 0x41f459
push esi
call fcn.0041f120
pop ecx
test al, al
je 0x41f459
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.0041f819
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0041f84f
test al, al
je 0x41f4de
test bl, bl
jne 0x41f487
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0041f1c7
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41f4d1
call fcn.0041fad6
ret
push 7
call fcn.0041f6fd
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.005b8000
jmp 0x41f37b
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x403d40
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 8], 0
push ebp
mov ebp, dword [esp + 8]
push edi
je 0x403da9
xor edi, edi
test ebx, ebx
jbe 0x403d6e
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
je 0x403d7c
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov al, byte [ecx + edx]
mov byte [edi + ebp], al
inc dword [esi + 0xc]
inc edi
cmp edi, ebx
jb 0x403d52
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop ebp
ret 4
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x10000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403d6e
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
jmp 0x403d5a
push esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0040e190
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
jmp 0x403d4c

Function at 0x40f110
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
lea ecx, [eax + eax]
lea eax, [esp]
push eax
xor edx, edx
push 1
push edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov word [esi], dx
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f15f
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
lea eax, [esp + 0x14]
push eax
push esi
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x4103e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4972c8]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push accept
push accept
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x4972c8]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x4972c0], eax
call esi
mov edx, dword [0x4972c0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x4972bc], eax
call esi
mov eax, dword [0x4972c0]
push 0
push eax
call esi
pop esi
ret

Function at 0x413678
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4136b3
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x41369a
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4136ab
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4136b5
inc edi
add eax, 0x28
cmp edi, esi
jb 0x413690
xor eax, eax
pop edi
pop esi
ret
Function at 0x413990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x88], eax
call fcn.00413638
and dword [eax + 0x458d2015], ecx
inc ebp
call 0x5129972e
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00413648
push eax
push esi
push dword [ebp + 8]
call fcn.004135fd
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00413648
push eax
push esi

Function at 0x4139a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x88], eax
call fcn.00413638
and dword [eax + 0x458d2015], ecx
inc ebp
call 0x5129972e
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00413648
push eax
push esi
push dword [ebp + 8]
call fcn.004135fd
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00413648
push eax
push esi
Function at 0x4142a3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.00413648
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004135fd
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.00413638
dec ebx
xchg byte [eax + 0x3c], ah
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x41432c
cmp dword [ebp - 0x398], 0
je 0x4144f6
cmp dword [ebp + 0xc], 1
je 0x4144f6
cmp dword [ebp + 0xc], 8
jne 0x4144be
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
stc
invalid
inc dword [eax]
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.00413648
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004135fd
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
stc
invalid
call dword [ebp - 0x3a]
test dword [ebx - 7], esp
invalid
dec dword [ebx - 0x69b7a3a]
invalid
invalid
in al, dx
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
call fcn.00413638
sbb al, dl
adc al, 0xd3
and byte [ebp - 0x544], 0
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.00413638
outsd dx, dword [esi]
ljmp 0xfdd0
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
Function at 0x41453a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00413616
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00413648
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004135fd
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00413638
into
scasd eax, dword es:[edi]
mov dl, 0x1a
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.00413638
daa
push eax
xlatb
mov es, word [eax - 0x7fff1f9b]
loope 0x41465a
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.00413648
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004135fd
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
invalid

Function at 0x421fa7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490e80]
jne 0x421fb1
repz ret
jmp fcn.00426243