joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f06
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a54], 0
push esi
jne 0x405f3d
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f17
mov dword [ecx*4 + 0x422a50], eax
inc ecx
cmp ecx, 0x100
jl 0x405f12
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f6e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a50]
xor eax, esi
inc ecx
dec edx
jne 0x405f50
pop edi
not eax
pop esi
ret 0xc

Function at 0xdee710
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdee71a
pushal
call 0xdee720
pop ebp
sub ebp, 0x10
sub ebp, 0x9ee710
jmp 0xdee736
mov eax, 0x9ee710
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b9
mov edx, 0xcc8e1abd
xor byte [eax], dl
inc eax
dec ecx
jne 0xdee74d
jmp 0xdee760
jo 0xdee799
xor al, 0x81
mov ebp, 0x7c3cbdbd
inc ebp
mov ebp, 0x70bebdbd
add eax, 0xbdbdbdb5
pop es
xchg ebp, eax
mov ebp, 0x5f4abdbd
mov esi, 0xb13c3675
mov ebp, 0x78bebdbd
xor cl, bl
cdq
inc ecx
xor al, 0xb9
cdq
xor cl, bl
cdq
inc ecx
xor al, 0xb9
cdq
aad 0x39
imul ebx, dword [ebp - 0x50ce2a43], 0x91bcbdc3
cdq
aad 0xd0
nop
nop
cwde
push ebp
mov eax, 0x54bdbdbd
xchg ebp, eax
mov ebp, 0x36e8bdbd
push ecx
cmp byte ss:[ebp + 0x36bdbdbd], dh
sub byte [ecx + 0x36bdbdbd], dh
xor byte [ebp + 0x7cbdbdbd], ch
push esp
mov edi, 0x7f3ebf8c
mov ecx, 0x4938b2f4
inc edx
inc edx
inc edx
loopne 0xdee855
aad 0x31
scasd eax, dword es:[edi]
ret
mov cl, 0xbd
xor dword ss:[ecx - 0x42424247], ebx
aad 0x39
imul ebx, dword [ebp - 0x50ce2a43], 0x91bcbdc3
cdq
in al, dx
push ebp
mov eax, 0x54bdbdbd
idiv byte [edi - 0x26cf4243]
cdq
inc ecx
xor al, 0x91
cdq
push ecx
inc edx
enter 0x42b1, 0xffffffffffffffc8
mov ch, 0x55
lds edi, [ebp + 0x36bdbd]
mov ch, 0xbd
mov ebp, 0x3c748ebd
dec edi
adc dword [esi], ebx
xor byte [ecx + 0x1e114f3c], dh
xor byte [ecx + 0x553e6f8e], dh
mov eax, 0xf339b2f5
mov ebp, 0x35b2bdbd
cmc
mov ebp, 0x36dbbdbd
mov eax, dword [0x55463d84]
mov dl, 0x39
cmpsd dword [esi], dword es:[edi]
mov ebp, 0x463dbdbd
push esp
mov dl, 0x39
lodsb al, byte [esi]
mov ebp, 0x3cdbbdbd
inc esi
inc edx
cwde
mov dl, 0x39
test al, 0xbd
mov ebp, 0x7154fcbd
inc edx
inc edx
inc edx
xchg esp, eax
int1
test byte [esi + edi + 0x553eb87c], bh
mov ecx, 0x42420054
inc edx
xchg esp, eax
jmp 0x7d1da7f1
Function at 0x42282a
Capabilities:
Create thread

Disassembly:
push 0x64
mov eax, 0x4277be
call fcn.004263c5
mov esi, edx
mov dword [ebp - 0x40], ecx
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov ebx, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 2
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x422865
mov ecx, dword [esi]
mov edi, dword [esi + 0x10]
inc edi
cmp dword [esi + 0x14], 8
lea edi, [ecx + edi*2]
jb 0x422874
mov esi, dword [esi]
sub edi, esi
je 0x422884
push edi
lea ecx, [ebp - 0x4c]
call fcn.00423ce4
mov ebx, dword [ebp - 0x4c]
push edi
push esi
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
lea eax, [ebx + edi]
add esp, 0xc
mov edi, dword [ebp - 0x40]
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x48], eax
mov edx, edi
lea eax, [ebp - 0x4c]
push eax
call fcn.0042295b
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
push 0x415f4c
mov dword [ebp - 0x50], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4228e8
push ecx
push ecx
lea edx, [ebp - 0x70]
mov byte [ebp - 0x70], bl
mov ecx, eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], 0x415f64
mov dword [ebp - 0x64], 0x415f74
call fcn.0042519f
cmp dword [ebp - 0x6c], ebx
je 0x4228e8
mov esi, dword [ebp - 0x6c]
lea eax, [ebp - 0x50]
push eax
push ebx
push dword [ebp - 0x58]
push esi
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
mov dword [ebp - 0x54], esi
test esi, esi
je 0x42292c
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x4c]
call fcn.0041958c
lea ecx, [ebp - 0x60]
call fcn.00422736
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
call fcn.00426374
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x415ed4
push eax
lea ecx, [ebp - 0x3c]
call fcn.0042256e
push 0x429148
lea eax, [ebp - 0x3c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x423dc7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x2c
mov eax, 0x4279d0
call fcn.0042638b
mov edi, dword [ebp + 0x10]
mov ebx, dword [edi + 4]
mov esi, dword [edi]
cmp esi, ebx
je 0x423def
mov ecx, esi
call fcn.00419f5b
add esi, 0x18
cmp esi, ebx
jne 0x423ddf
mov esi, dword [edi]
mov eax, dword [ebp + 8]
mov dword [edi + 4], esi
cmp dword [eax + 0x14], 8
jb 0x423dfd
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
xor ebx, ebx
push ecx
push 0x20119
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x423f02
mov esi, dword [ebp - 0x18]
push 0xc
call fcn.00425677
pop ecx
mov ecx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x20], eax
mov dword [eax], 0x40150c
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 0xc]
mov eax, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
cmp dword [esi + 0x14], 8
jb 0x423e53
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push ecx
push ebx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423efa
cmp dword [ebp - 0x14], 1
je 0x423e7b
cmp dword [ebp - 0x14], 7
jne 0x423efa
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
shr eax, 1
push ecx
add eax, 2
lea ecx, [ebp - 0x2c]
push eax
call fcn.004196a1
mov byte [ebp - 4], 2
cmp dword [esi + 0x14], 8
jb 0x423ea6
mov esi, dword [esi]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423eea
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x2c]
sub ecx, eax
sar ecx, 1
mov word [eax + ecx*2 - 4], dx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
sub ecx, eax
sar ecx, 1
mov word [eax + ecx*2 - 2], dx
mov edx, edi
mov ecx, dword [ebp - 0x2c]
call fcn.00423f3a
lea ecx, [ebp - 0x2c]
call fcn.00419677
lea ecx, [ebp - 0x38]
call fcn.00419768
lea ecx, [ebp - 0x1c]
call fcn.00417cfb
call fcn.00426359
ret 0x10
Function at 0x42424b
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x42abd0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
mov edx, ecx
mov dword [ebp - 0x50], edx
push edi
test esi, esi
jne 0x424272
push 0x57
jmp 0x4242e5
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x6c]
push 0x1c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x6c]
push eax
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x4242eb
mov edi, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
push 0
push 0x40
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4242eb
mov eax, 0x5a4d
cmp word [ebp - 0x4c], ax
jne 0x4242e0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x60]
ja 0x4242e0
cmp eax, 0x40
jb 0x4242e0
push 0
push 0xf8
push ebx
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4242eb
cmp dword [ebx], 0x4550
jne 0x4242e0
xor eax, eax
inc eax
jmp 0x4242ed
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425660
leave
ret 4
Function at 0x42519f
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x428e80
call fcn.00425ea0
mov dword [ebp - 0x1c], edx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
xor esi, esi
test ebx, ebx
jne 0x4251d9
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [ebp - 0x20], eax
test ebx, ebx
jne 0x4251d9
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x425359
mov dword [ebp - 4], esi
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x4251f0
push 0xc1
jmp 0x42534c
mov eax, dword [ebx + 0x3c]
cmp dword [eax + ebx], 0x4550
je 0x425206
push 0xbf
jmp 0x42534c
cmp word [eax + ebx + 0x14], si
je 0x425347
mov eax, dword [eax + ebx + 0x80]
test eax, eax
lea edi, [eax + ebx]
jne 0x425221
mov edi, esi
mov dword [ebp - 0x2c], edi
test edi, edi
je 0x425347
mov edx, dword [edi]
test edx, edx
je 0x42530a
mov ecx, dword [edi + 0xc]
lea eax, [ebx + ecx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 0x30], ecx
je 0x425347
lea eax, [ebx + edx]
mov dword [ebp - 0x28], eax
mov ecx, dword [edi + 0x10]
lea eax, [ebx + ecx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ecx]
call fcn.004250d9
push dword [ebp - 0x30]
push eax
push dword [ebp - 0x1c]
mov ecx, 0x422a10
call dword [0x42c20c]
mov eax, 0x422a10
call eax
test eax, eax
je 0x42530a
mov eax, esi
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4252ff
mov ecx, dword [ecx + eax*4]
test ecx, ecx
je 0x4252e7
mov edx, esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], esi
jns 0x4252af
movzx edx, cx
mov dword [ebp - 0x34], edx
mov ecx, esi
jmp 0x4252ba
add ecx, 2
je 0x4252b8
add ecx, ebx
jmp 0x4252ba
mov ecx, esi
mov ebx, dword [ebp - 0x38]
push dword [ebx + eax*4]
push ecx
push edx
push dword [ebp - 0x1c]
mov ebx, 0x422a70
mov ecx, ebx
call dword [0x42c20c]
call ebx
test eax, eax
mov ebx, dword [ebp - 0x20]
je 0x4252e7
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
jmp 0x425294
push esi
push esi
push esi
push dword [ebp - 0x1c]
mov ecx, 0x422a70
call dword [0x42c20c]
mov eax, 0x422a70
call eax
add edi, 0x14
mov dword [ebp - 0x2c], edi
jmp 0x42522c
push esi
push esi
push dword [ebp - 0x1c]
mov ebx, 0x422a10
mov ecx, ebx
call dword [0x42c20c]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x42535b
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4256af
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x4256ec
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x4256e5
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x4256f1
add edx, 0x28
cmp edx, esi
jne 0x4256d6
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x4256ee
Function at 0x1e7a7500
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 4], 0x1e7ba2c0
je 0x1e7a751c
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
ret 8
mov eax, dword [eax + 8]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [esp + 8]
cmp ecx, 2
jne 0x1e7a7541
test eax, eax
je 0x1e7a754a
mov eax, dword [sym.imp.python27.dll__Py_TrueStruct]
inc dword [eax]
ret 8
cmp ecx, 3
jne 0x1e7a7554
test eax, eax
je 0x1e7a7537
mov eax, dword [sym.imp.python27.dll__Py_ZeroStruct]
inc dword [eax]
ret 8
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
ret 8

Function at 0x1e7a8dc7
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1e7a8e02
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1e7a8de9
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1e7a8dfa
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1e7a8e04
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1e7a8ddf
xor eax, eax
pop edi
pop esi
ret

Function at 0x1e7a9000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x1e7a8fe1
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x1e7a8fdb
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x1e7a8fcc
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov al, 0xde
mov al, 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.1e7a8d87
mov esi, esp
push ebp
jb 0x1e7a8fbd
inc ebp
test al, 0x50
call fcn.1e7a8d97
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a8d4c
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1e7a9075
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1e7a8d87
pop ss
xlatb
lock sbb dword [ebp - 0x17af3fbb], ecx
invalid
Function at 0x1e7a9480
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a94da
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
or byte gs:[eax], al
add byte [eax], al
inc eax

Function at 0x1e7a94a0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a945e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a947c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
or byte gs:[eax], al
add byte [eax], al
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a94c1
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a94ca
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a94d4
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a94b6
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1e7a9440
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x1e7a94c0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a945e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a947c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
or byte gs:[eax], al
add byte [eax], al
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a94c1
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a94ca
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a94d4
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a94b6
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1e7a9440
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x1e7a9500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1e7a9527
dec eax
je 0x1e7a951e
sub eax, 3
je 0x1e7a9515
mov dword [ebp - 4], 0x40
jmp 0x1e7a9544
mov dword [ebp - 4], 4
jmp 0x1e7a952a
mov dword [ebp - 4], 0x20
jmp 0x1e7a952a
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1e7a9576
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1e7a94f6
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1e7a8d87
jae 0x1e7a95d7
mul dword [esi]
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x1e7a9582
push 0x8000
push ebx
push esi
call dword [ebp - 8]
call dword [edi - 0x3a]
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
invalid
invalid
invalid
cld
invalid
invalid

Function at 0x1e7a9c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ebp - 0x22e43], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1e7a8d65
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
call dword [ecx]

Function at 0x1e7a9d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ecx]
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.1e7a8d97
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a8d4c
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.1e7a8d87
xor byte [0x468d8d8], dl
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
Function at 0x404a54
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 0xc], ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call sub.rtl260.bpl__System__LStrAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
mov ax, word [ebp - 6]
mov word [ebp - 0x10], ax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call sub.rtl260.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
test ax, ax
jbe 0x404ade
mov word [ebp - 0x12], ax
mov word [ebp - 0xe], 1
mov eax, dword [ebp - 0xc]
call sub.rtl260.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
movzx edx, word [ebp - 0xe]
movzx ecx, word [ebp - 0xe]
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx]
mov cl, byte [ebx + ecx - 1]
movzx ebx, word [ebp - 0x10]
shr ebx, 8
xor cl, bl
mov byte [eax + edx - 1], cl
movzx eax, word [ebp - 0xe]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
add ax, word [ebp - 0x10]
imul ax, ax, 0xce6d
add ax, 0x58bf
mov word [ebp - 0x10], ax
inc word [ebp - 0xe]
dec word [ebp - 0x12]
jne 0x404a91
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404e10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 0xc], ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call sub.rtl260.bpl__System__LStrAsg_qqrr27System__AnsiStringT_us_i0__x27System__AnsiStringT_us_i0__
mov ax, word [ebp - 6]
mov word [ebp - 0x10], ax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call sub.rtl260.bpl__System__LStrLen_qqrx31System__AnsiStringT_us_i65535__
test ax, ax
jbe 0x404e9c
mov word [ebp - 0x12], ax
mov word [ebp - 0xe], 1
mov eax, dword [ebp - 0xc]
call sub.rtl260.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
movzx edx, word [ebp - 0xe]
movzx ecx, word [ebp - 0xe]
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx]
mov cl, byte [ebx + ecx - 1]
movzx ebx, word [ebp - 0x10]
shr ebx, 8
xor cl, bl
mov byte [eax + edx - 1], cl
movzx eax, word [ebp - 0xe]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
movzx eax, byte [edx + eax - 1]
add ax, word [ebp - 0x10]
imul ax, ax, 0xce6d
add ax, 0x58bf
mov word [ebp - 0x10], ax
inc word [ebp - 0xe]
dec word [ebp - 0x12]
jne 0x404e4d
pop ebx
mov esp, ebp
pop ebp
ret