joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401474
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0x124]
sub esp, 0x144
mov dword [ebp - 0x124], 0xa
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x116]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], eax
mov byte [ebp - 0x10c], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
movsx ebx, byte [ebp - 0x116]
lea eax, [ebp - 0x120]
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
sub ebx, 0x41
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4014ec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xa0
mov dword [ebp - 0x88], 0
call fcn.00401474
mov dword [esp], 0x4015c8
mov dword [ebp - 0x8c], 0
mov ebx, eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0xc], eax
mov eax, ebx
or eax, 0x40
mov dword [esp + 8], eax
mov eax, 0x40202a
sub eax, 0x4015c8
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401591
lea esi, [ebp - 0x88]
mov dword [esp], ebx
call fcn.0040137a
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004013df
lea eax, [ebx + 0x1b800]
mov ecx, 0x40300c
or eax, ebx
or ecx, 1
xor edx, edx
mov dword [esp + 4], eax
mov eax, ebx
div ecx
mov dword [esp + 8], esi
add eax, 0x40300c
mov dword [esp], eax
call fcn.00401d2d
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret

Function at 0x168fda8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x168fdae
ret
Function at 0x4a143c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a1511
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a152c
push ebx
push 0x4a153c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087a4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405864
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084c8
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4a14bc
mov al, 0x72
call fcn.004a1064
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004a1410
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4a14c5
call fcn.004a1410
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1518
lea eax, [ebp - 4]
call fcn.004079f4
ret

Function at 0x4a162c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a16f7
jmp 0x4a16eb
cmp dword [esi + 0x10], 0x1000
jne 0x4a16d7
test byte [esi + 0x15], 1
jne 0x4a16d7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4a1688
cmp ebp, 2
je 0x4a1688
cmp ebp, 0x10
je 0x4a1688
cmp ebp, 0x20
jne 0x4a16a4
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a16a4
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4a16b5
mov eax, dword [esi]
add eax, ebx
call fcn.004a1624
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4a16a8
cmp byte [esp + 4], 0
je 0x4a16d7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a16f7
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4a165d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4036a5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4036e4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4036e4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4036e4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4036e4
cmp dword [ecx + 0x74], 0xe
jbe 0x4036e4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x44a8d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
push ebp
lea eax, [esp + 8]
push esi
push eax
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x44a9c3
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]

Function at 0x44a920
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44a942
mov edx, dword [0x651d44]
push 0x651a78
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, ebx
or eax, 0x8001
push eax
call edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll__lcreat]
push ebx
mov esi, eax
call edi
call dword [sym.imp.USER32.dll_GetActiveWindow]
pop edi
cmp esi, 0xffffffff
pop ebx
je 0x44a975
push esi
invalid
invalid
dec esp
invalid
invalid
Function at 0x4a479a
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0xd714851d
cmp esp, dword [eax - 0x280e699b]
xchg dword [ecx - 0x4dfdfe11], ecx
shr byte [ecx + 0x228ee338], cl
push edx
push ecx
or dl, ah
mov byte [0x3cd62a86], al
cli
dec ebp
mov al, byte [0x5b20d0b6]
add dh, bh
adc dh, dh
sub al, 0x18
add edi, dword [ebx + eax*8]
mov cl, 0x7b
xor edi, esp
or byte [ebp - 0x51], ch
out dx, eax
jl 0x4a47f4
sbb al, 0x30
scasd eax, dword es:[edi]
xchg esi, eax
jo 0x4a4778
invalid
aam 0x11
aas
enter 0xc93, 0x18
push es
punpckldq mm7, dword [edi - 0x299520e6]
jb 0x4a485a
iretd
dec esp
nop
and ebx, dword [esi + ecx - 0x6f8ebca2]
jne 0x4a48c7
push ecx
out 0xc8, al
outsd dx, dword [esi]
mov byte [ebx - 0x1c], ch
push ebp
salc
retf
push 0xc0a1bcdb
int1
mov byte [0x54292536], al
int1
shl ebx, 1
mov al, 0xa1
push esi
add ebx, dword [edx]
das
cmp eax, 0xf1108ffd
jae 0x4a489d
xchg dword [esi + ecx*2 + 0x61], ebx
retf
add eax, 0xa07375af
inc ebx
pop edi
aam 0xb8
jle 0x4a4875
jmp 0xa0a7a3ce
pop esp
jae 0x4a490c
inc esi
pushal
mov esi, 0xe183e430
mov edi, 0x7f8efec8
or al, 0xc2
daa
scasd eax, dword es:[edi]
and ebp, edi
push ebx
nop
salc
xchg ecx, eax
fist word [esi + 0x62]
mov ah, 0x2a
cmp eax, 0xeff65325
jge 0x4a4895
jno 0x4a4943
lea ebx, [ecx]
mov ebx, 0x4f33815b
xchg edx, eax
sub ah, al
or dh, byte [eax]
movsd dword es:[edi], dword [esi]
mov eax, dword [0xe0700b5b]
push ebx
jno 0x4a491e
and eax, 0x5c8f1df2
invalid
mov byte [0xd55d31f1], al
xor byte [edx], 0xd7
sbb byte [ebx - 0x42], bh
and al, 0xa2
invalid
imul esi, esp, 0x228b9885
ret
mov bh, 0x6a
mov al, 0xf4
inc ecx
adc ebx, esp
scasb al, byte es:[edi]
sar dword [esi + 0x7219354c], 1
in eax, 0x73
test al, 0x26
inc ebp
mov ebp, 0xce0bbb45
into
test dh, 0x43
fld dword [ebx]
sub eax, 0xf3f254d2
xchg dh, ah
xchg ebp, eax
adc byte [esi + 0x63e4398d], cl
xchg edi, eax
outsb dx, byte [esi]
xor byte [ebp + esi*8 + 0x22], dh
int 0xf1
movsb byte es:[edi], byte [esi]
aas
cmp ecx, eax
in eax, dx
dec eax
inc ebx
popal
salc
jo 0x4a49f8
or esp, edx
inc edx
fdiv qword [0x2a27b582]
and ah, byte [0x21666c58]
cmp al, 0x65
xchg ebx, eax
lds ecx, [ebx]
popfd
fild dword [edx + edi*2 - 0x7e6e401d]
popal
pop ds
inc ecx
push 0xffffffffffffffd6
loope 0x4a495b
and dword [ecx + 0x1f], 0xe1d66a41
mov bl, 0xe1
push ebp
loope 0x4a49ff
out 0x2a, al
fbld tbyte [edx + ebx*8]
or dh, bh
lock and esp, dword [ebx - 0x2c897dc8]
hlt
insb byte es:[edi], dx
loopne 0x4a49fb
push 0xe073222b
jno 0x4a49a0
stc
rcr byte [edi - 0x4e599f45], 0xb
pushal
cmpsb byte [esi], byte es:[edi]
mov cl, 0xb
jo 0x4a49dc
jl 0x4a49d2
invalid
push cs
pushal
scasb al, byte es:[edi]
add eax, 0xe5eb435b
xchg byte [ebx], ah
mov eax, dword [0x97fb83a4]
nop
xchg edi, eax
xor dl, byte [edi + 0x43c053de]
les esi, [ebx - 0x69]
rcr ecx, 1
push ss
lock sub byte es:[edx + ebp*2], bh
sub byte [edx + ebp*2], bh
vmread ebx, eax
js 0x4a49c4
lcall 0xa863, 0xb9f381c2
mov esp, 0xca9e9bf9
sub eax, 0xf2156073
mov cl, 0xef
or eax, 0xfbb1bfe
shr dword [esi + 0x37], 0xae
mov dword [ecx], edi
pop ebp
retf
Function at 0x500733
Capabilities:
Encode data using xor

Disassembly:
invalid
popal
out 0x55, al
lds ebx, [ebx + 0x6ef1bf9e]
call 0xd8299cc3
push ds
js 0x5006d9
xchg ebp, eax
invalid
test dword [ebx - 0x54], edi
or ah, byte [edi]
clc
xor dword [ebx - 0x6b25a350], ebp
xchg esp, eax
xchg esp, eax
pop ecx
cmpsd dword [esi], dword es:[edi]
sub al, 0x24
xchg dword [edi - 0x56], ebp
fisttp word [ebp + 9]
dec byte [eax - 0x71fbf342]
dec eax
mov al, byte cs:[edi + 0x4800ccb7]
add byte [esi + 0x19f51068], bh
test byte [ebx + esi*4 + 0x3c09d007], ch
leave
xchg edx, eax
jl 0x500717
cmp byte [edx - 0x5a], cl
pause
push ebp
cli
adc byte [ebp*4 + 0x541e2584], ch
push ds
push esp
in al, dx
push edx
add eax, 0xc7525450
mov cr4, ebx
pop esi
mov ecx, 0xbf81a584
dec esi
jno 0x500722
adc al, 0x22
or byte [edx + 0x29a39e45], 4
mov esi, edi
cdq
push esi
out dx, al
xor eax, 0x860e8b68
mov edx, 0x252b7f5e
pop eax
sbb al, 0xa5
arpl word [0x4ca3fd7b], si
adc byte [esi + edi*2 + 0x8740126], 0xd1
inc eax
mov eax, dword [0x610043a9]
movsd dword es:[edi], dword [esi]
mov ch, 0x51
call 0xef82fc43
jbe 0x50078e
xor eax, ecx
or edx, dword [edi]
jmp 0x500769

Function at 0x52ed54
Capabilities:
Encode data using xor

Disassembly:
or al, 0xf
adc dword [ebp + edx*8 - 0xa], ebp
cmp al, 0xe7
fmul st(7), st(0)
sbb dh, byte [ebx]
rcr dword [esi], 0x71
jo 0x52edd2
out dx, eax
imul ebx, dword [edx - 0x18], 0xd172090e
mov bh, 0x31
mov gs, word [esi - 0x7a]
jl 0x52edf3
dec eax
mov esi, 0x2fb46e3d
xor al, 0x52
push eax
inc bx
vpsrld xmm6, xmm7, xmm5
mov ecx, 0x7d368c36
xchg ebx, eax
sub eax, 0x472c6a81
insb byte es:[edi], dx
retf 0xd710
fmul dword [edx + 0x6b]
pop esi
sahf
mov es, word [esi + ebx*2 + 0x5af1cb55]
pop edx
xor esi, edi
fldcw word [ebp + 0x5e]
xchg esi, eax
sub byte [edx + 0x1f5b1059], ch
je 0x52edc7
xor eax, 0x9bad7c9d
salc
clc
iretd
pop eax
out dx, eax
fnstcw word [edi]
and eax, 0xfd1742ee
out 0xc, al
int1
imul esp, ebp, 0x3b067ba9
push eax
salc
xor eax, 0x491c5ca7
sub ebp, dword [ecx + ebp - 0x12]
mov al, byte [0x3eef9c73]
pop ds
cmp ebx, dword [edi - 0x62]
imul edx, dword [ebp - 0x1f0210c8], 0xffffff99
push 0xfffffffffffffffe
wait
in al, dx
mov dword [0xc6ecd6e5], eax
mov bl, 0xd5
stosb byte es:[edi], al
outsb dx, byte [esi]
int3
Function at 0x5636e3
Capabilities:
Encode data using xor

Disassembly:
into
add ebx, eax
add dword [eax + eax*4 + 0x5c], esp
nop
movsd dword es:[edi], dword [esi]
jb 0x5636c3
mov ecx, 0x5fe8c121
jl 0x56366b
push 0x6b07a9a2
aas
std
jg 0x5636f1
add dword [esi + 0x48], 4
shr dword [ebp + 0xdf67208], 1
and edi, dword [edi - 0x172740a]
push es
xchg esp, eax
push ds
cmp dword [esi + ebp*4 - 0x7c], 0x76
mov esp, cs
xor al, 0x52
pop edx
add bl, byte [0xf395e9ef]
push ss
in al, 0x1c
loopne 0x56368e
jb 0x563686
or eax, 0x8bf6bf23
invalid
and dword [ebp + 0x4f], ecx
mov ch, 0xde
push ds
mov esp, 0xea9a8475
or byte [eax + 0x25], ah
pop edi
lodsd eax, dword [esi]
dec edx
jecxz 0x563676
pop ds
adc eax, 0x5ae8914d
mov esi, 0x2e407a0e
arpl word [edi], di
loope 0x5636b3
pop esi
insd dword es:[edi], dx
mov edi, 0xb59cc422
das
xor al, 0x2f
aas
iretd
xlatb
xor ebx, 0xfffffffc
fsubr dword [edi - 0x35]
pop esp
lodsb al, byte [esi]
loopne 0x56367b
jo 0x56370f
retf
out 0x9f, eax
popfd
lodsd eax, dword [esi]
fmul qword [edi - 0x25f90383]
into
lds esp, [0xb10da87d]
out dx, al
cli
mov es, word [edi + 0x1a]
push ds
mov esp, 0xab61acb9
pop edx
ror dword [ebx], 1
mov bh, 0x57
in al, dx
or eax, ecx
pop esp
sub ch, bl
jbe 0x563789
add dword [eax - 0x3c5d6309], esp
sbb dword [ebx + 0x20], esi
invalid
stosd dword es:[edi], eax
xchg ecx, eax
cmp dword [esi + 0x44ea828], edi
imul edi, dword [ecx + 0x5c], 0x67ad1e47
retf

Function at 0x5b448b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
sub ch, dh
jns 0x5b4485
sub edx, dword [ecx - 0x985b415]
dec ebx
jp 0x5b4415
retf 0xc83f
sub eax, 0x349ad055
pop edi
or dword [ebp - 0x54], esp
rcr byte [edx + 0x65095f34], 1
lodsb al, byte [esi]
xchg esp, eax
je 0x5b441c
jp 0x5b4454
std
or al, 0x2b
pop ecx
invalid
out 0xe5, eax
pavgb mm5, qword [eax]
inc ebx
and byte [esi - 0x35309acb], bh
inc ecx
inc ecx
and dword [ebp - 0x5d7c4a11], 0x3eb147c9
sar bh, 1
jo 0x5b4447
inc dword [ebx]
xchg ebp, eax
xor al, 0xf6
ja 0x5b44a2
push eax
mov dword [0x4559d85c], eax
jge 0x5b44c5
mov esp, 0xa9368f02
xchg dword [eax], ebx
std
out dx, al
dec ebp
fst st(5)
pop ds
pop eax
popal
jmp 0x5b4429
pop ds
scasb al, byte es:[edi]
cmp dword [ecx + edi*8], esp
pop ecx
scasd eax, dword es:[edi]
xor eax, 0x908fa00d
and al, 0x87
jp 0x5b442b
imul dword [ecx - 0x71]
out dx, ax
sar dword [eax - 0x10ba25c4], 0x85
mov dword [0xd5d81547], ebx
sbb eax, 0xd5d81547
pop ebp
add byte [ebx + 0x6e284e23], ah
push 0x5b
out dx, eax
dec edi
aas
retf
push esp
or bl, byte [edx - 0x701e8079]
rcl dword [ebx + 0x45644878], 0xa5
sbb eax, dword [edi]
cdq
mov ebx, gs
invalid
Function at 0x631b81
Capabilities:
Encode data using xor

Disassembly:
aad 0xf6
mov dh, 0xeb
and al, 0xf4
adc esp, ebx
cwde
enter 0xffffffffffffa022, 0xa
outsb dx, byte [esi]
out dx, al
cwde
mov dh, byte [edi - 0x4a69b4db]
lcall 0x4c9f, 0xc3bd7e9
popfd
sahf
std
and byte [ebx + 0x4126ec71], al
add byte [esi - 0x1459c4ab], ch
rdpmc
cmpsb byte [esi], byte es:[edi]
xchg ebx, eax
dec edi
add ch, byte [ecx]
add eax, 0xf19b24f7
mov bl, 0xae
out dx, al
aam 0x9f
xlatb
sub eax, 0x38ef4ca9
add dword [eax + 0x22277a5e], ebx
aas
sub bl, byte es:[ebp - 0x5e]
mov esp, dword [esi - 0x52]
sub byte [eax - 0x43], 0x62
bound edx, qword [edi + 0x2bb331a4]
enter 0xffffffffffffdcc1, 0xffffffffffffff96
jmp 0x9f6f571f
bound edx, qword [edi + 0x2bb331a4]
enter 0xffffffffffffdcc1, 0xffffffffffffff96
or eax, 0x306423e4
pop ss
lcall 0x2776, 0x2929ca9a
mov byte [esi], bh
jns 0x631b43
cmp bh, byte [esi + 0x3f]
jbe 0x631bdd
inc ebp
jg 0x631b2c
mov edx, 0x899cc2a6
das
shr dword [ecx + ebp*8 + 0x55], cl
fidivr dword [esi + ebx*2]
add dword [ebx], edx
stosd dword es:[edi], eax
outsb dx, byte [esi]
in eax, 0x43
dec esp
cld
jle 0x6c6bb101
mov es, word [ecx - 0x6b]
or byte [ebp + ebx*2 + 0x6a], ch
wait
pop ebp
push 0x65
wait
mov dh, 0x3e
jge 0x631c23
movsb byte es:[edi], byte [esi]
pop es
jl 0x631bbb
out 0xa8, eax
push di
not byte [ebx + 0x4bfa8926]
imul byte [edx - 6]
jle 0x631c03
mov esp, 0x547a1bb6
sbb edi, dword [edx + 0x54]
rcl dword [edi - 0x495a947b], cl
cld
mov ebp, 0x97165a80
and al, 0xa7
invalid
xchg byte [eax - 0x195b0d70], ch
adc ecx, dword [eax - 0x7552e6d2]
sbb dword [esi + 0x4a], esp
test byte [ebx], cl
xor al, 0x3b
and cl, byte [edx - 0x2a]
xor eax, dword [eax + 0x5a]
test eax, 0x96b9649
scasb al, byte es:[edi]
js 0x631c3c
sbb byte [edi - 0x38b50a47], dh
pushfd
xchg esi, eax
wait
mov ch, bl
movsd dword es:[edi], dword [esi]
jecxz 0x631c37
mov bh, 0xb9
cmc
dec edx
invalid
je 0x631be7
sub dh, byte cs:[edx]
mov al, byte [0x5c6b4a32]
xor cl, byte [edx + 0x6b]
pop esp
inc esi
mov bl, 0x70
adc cl, bl
and al, 0x96
sti
out dx, al
mov dh, 0x23
cmc
add dl, ah
js 0x631c3b
xchg esp, eax
pop es
cli
mov eax, dword ds:[0xa72f4d0b]
inc esi
sub byte [ebp + edi*2 + 0x69707911], ah
jbe 0x631c68
mov ecx, 0xa66faf4d
sbb byte [ecx + 0x501b8191], 0x21
lodsb al, byte [esi]
dec ebx
sbb dword [ebx], 0x4bac2150
invalid
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40bdb9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40bdc8
pop dword [ebp - 0x30]
mov eax, 0xbb9f5ad9
add eax, 0x44a162ef
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xd44a4042
sub dword [ebp - 0x40], 0x85f7faf7
mov dword [ebp - 0x3c], 0x76c9118b
sub dword [ebp - 0x3c], 0x4495c546
mov dword [ebp - 0x38], 0x68600f79
sub dword [ebp - 0x38], 0x1c13cb4b
mov dword [ebp - 0x34], 0x2f08ca0e
add dword [ebp - 0x34], 0xd0f735f2
lea eax, [ebp - 0x40]
push eax
mov eax, 0x3e458e9f
add eax, 0xc1fb41b5
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x4f295563
add dword [ebp - 0x40], 0x254913f3
mov dword [ebp - 0x3c], 0x259d4919
sub dword [ebp - 0x3c], 0xe430e7a4
mov dword [ebp - 0x38], 0x9e7fb8ec
sub dword [ebp - 0x38], 0x3b104c80
mov dword [ebp - 0x34], 0x7e500276
sub dword [ebp - 0x34], 0x7e500276
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x8c96b24c
sub eax, 0x8c55e200
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x39b86
push 0
call eax
mov ecx, 0x7729fda9
add ecx, 0x88d64b24
mov edi, eax
mov esi, 0xdbc11f7c
sub esi, 0xdb7f6f7c
add esi, dword [ebp - 0x30]
mov ebx, 0x82a2c39
xor dword [ebp - 4], edx
mov edx, dword [esi]
add dword [ebp - 0x14], edx
xor edx, ebx
mov dword [edi], edx
sub dword [ebp - 8], esi
add edi, 0x63a422a7
add edi, 0x9c5bdd5d
add esi, 4
loop 0x40bee4
add eax, 0x11607
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x395a1a6e
add ecx, 0xc6e5e592
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x49078a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4907d1
call fcn.00493817
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4907d1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4907ed
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00490304
mov esi, eax
test edi, edi
je 0x4907eb
test ebx, ebx
je 0x4907eb
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4a47ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4dcac0]
jne 0x4a47c4
repz ret
jmp fcn.004ab99c

Function at 0x4b4def
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004ab2e1
and dword [ebp - 4], 0
cmp dword [0x4e0844], 0
mov ebx, eax
jne 0x4b4ea0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4b4f51
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4cbf78
push edi
call esi
test eax, eax
je 0x4b4f51
push eax
call fcn.004ab26f
mov dword [esp], 0x4cbf68
push edi
mov dword [0x4e0844], eax
call esi
push eax
call fcn.004ab26f
mov dword [esp], 0x4cbf54
push edi
mov dword [0x4e0848], eax
call esi
push eax
call fcn.004ab26f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4e084c], eax
call esi
push eax
call fcn.004ab26f
pop ecx
mov dword [0x4e0854], eax
test eax, eax
je 0x4b4ea0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004ab26f
pop ecx
mov dword [0x4e0850], eax
mov eax, dword [0x4e0850]
cmp eax, ebx
je 0x4b4ef8
cmp dword [0x4e0854], ebx
je 0x4b4ef8
push eax
call fcn.004ab2ea
push dword [0x4e0854]
mov esi, eax
call fcn.004ab2ea
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4b4ef8
test edi, edi
je 0x4b4ef8
call esi
test eax, eax
je 0x4b4eef
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4b4eef
test byte [ebp - 0xc], 1
jne 0x4b4ef8
or dword [ebp + 0x10], 0x200000
jmp 0x4b4f31
mov eax, dword [0x4e0848]
cmp eax, ebx
je 0x4b4f31
push eax
call fcn.004ab2ea
pop ecx
test eax, eax
je 0x4b4f31
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4b4f31
mov eax, dword [0x4e084c]
cmp eax, ebx
je 0x4b4f31
push eax
call fcn.004ab2ea
pop ecx
test eax, eax
je 0x4b4f31
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4e0844]
call fcn.004ab2ea
pop ecx
test eax, eax
je 0x4b4f51
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4b4f53
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ed81
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x40eae0
call fcn.0040edaa
add esi, 0xbe8f8737
xor dword [ebx], eax
add ebx, 1
sub esi, 1
cmp ebx, ecx
jne fcn.0040ed81
and esi, edx
and edx, edx
ret
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov al, 0x45
push esi
mov esi, ecx
mov byte [esp + 5], al
mov byte [esp + 8], al
mov al, 0x69
xor ecx, ecx
mov byte [esp + 0x16], al
mov byte [esp + 0x18], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x20], al
mov byte [esp + 0x22], al
mov byte [esp + 0x2a], al
mov dword [esi + 0xc], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov byte [esp + 0x10], cl
mov byte [esp + 0x2d], cl
lea eax, [esp + 0x14]
lea ecx, [esp + 4]
mov dl, 0x6c
push eax
push ecx
mov dword [esi], 0x40f1d0
mov byte [esp + 0xc], 0x4b
mov byte [esp + 0xe], 0x52
mov byte [esp + 0xf], 0x4e
mov byte [esp + 0x11], 0x4c
mov byte [esp + 0x12], 0x33
mov byte [esp + 0x13], 0x32
mov byte [esp + 0x14], 0x2e
mov byte [esp + 0x15], 0x64
mov byte [esp + 0x16], dl
mov byte [esp + 0x17], dl
mov byte [esp + 0x1c], 0x49
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x21], 0x61
mov byte [esp + 0x22], dl
mov byte [esp + 0x24], 0x7a
mov byte [esp + 0x25], 0x65
mov byte [esp + 0x26], 0x43
mov byte [esp + 0x27], 0x72
mov byte [esp + 0x29], 0x74
mov byte [esp + 0x2b], 0x63
mov byte [esp + 0x2c], 0x61
mov byte [esp + 0x2d], dl
mov byte [esp + 0x2e], 0x53
mov byte [esp + 0x2f], 0x65
mov byte [esp + 0x30], 0x63
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x33], 0x6f
mov byte [esp + 0x34], 0x6e
call dword [sym.imp.kernel32.dll_GetStringTypeW]
push eax
call dword [sym.imp.kernel32.dll_GetConsoleNlsMode]
lea edx, [esi + 0x10]
push edx
call eax
mov eax, esi
pop esi
add esp, 0x2c
ret