joyce8/EMBER2024-capa huggingface dataset:
Function at 0xdcbdd4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdcbdde
pushal
call 0xdcbde4
pop ebp
sub ebp, 0x10
sub ebp, 0x9cbdd4
jmp 0xdcbdfa
mov eax, 0x9cbdd4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d2
mov edx, 0x8cc22709
xor byte [eax], dl
inc eax
dec ecx
jne 0xdcbe11
jmp 0xdcbe24
mov ecx, ebp
mov ecx, dword [ecx + 0x3c]
add ecx, 0xf8
add ecx, ebp
mov eax, 5
mov edx, 0x28
mul edx
add ecx, eax
mov eax, dword [ecx + 0xc]
add eax, ebp
lea esp, [esp - 4]
mov dword [esp], eax
lea esp, [esp - 4]
mov dword [esp], eax
push 0x2125c4
push 0x7b9810
add dword [esp], ebp
push 0x1e7632b9
call fcn.00dcbe74
jmp 0xdcbea4
mov ecx, dword [esp + 4]
push 0x2125c4
push 0x7b9810
add dword [esp], ebp
lea esp, [esp - 4]
mov dword [esp], ecx
call fcn.00dcbec9
jmp 0xdcc114
pop edi
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0xdcc125
mov eax, 0x9cbdd4
add eax, ebp
add eax, 0x377
mov ecx, 0x2a7
mov edx, 0x9cda986
xor byte [eax], dl
inc eax
dec ecx
jne 0xdcc13c
jmp 0xdcc14f
xchg esi, edi
mov edi, dword [esi + 0x3c]
mov edi, dword [edi + esi + 0xa0]
add edi, esi
push esi
pop ebx
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x34]
sub ebx, eax
mov edx, dword [edi]
xchg ecx, edi
mov edi, dword [ecx + 4]
xchg ecx, edi
cmp edx, 0
je 0xdcc1c7
add edx, esi
add edi, 8
sub ecx, 8
cmp ecx, 0
je 0xdcc16b
mov ax, word [edi]
shr eax, 0xc
and eax, 0xf
cmp eax, 3
jne 0xdcc1bd
mov ax, word [edi]
and eax, 0xfff
add eax, edx
add dword [eax], ebx
dec ecx
dec ecx
add edi, 2
jmp 0xdcc18f
jmp 0xdcc1d0
mov eax, 0x9cbdd4
add eax, ebp
add eax, 0x422
mov ecx, 0x1fc
mov edx, 0x1013b787
xor byte [eax], dl
inc eax
dec ecx
jne 0xdcc1e7
jmp 0xdcc1fa
mov edi, dword [esi + 0x3c]
mov edi, dword [edi + esi + 0x80]
add edi, esi
cmp dword [edi + 0xc], 0
je 0xdcc2d0
mov eax, dword [edi + 0xc]
add eax, esi
lea esp, [esp - 4]
mov dword [esp], eax
call dword [ebp + 0x7b8e1c]
cmp eax, 0
jne 0xdcc240
mov eax, dword [edi + 0xc]
add eax, esi
lea esp, [esp - 4]
mov dword [esp], eax
call dword [ebp + 0x7b8e28]
cmp dword [edi + 0xc], 0
je 0xdcc2d0
cmp dword [edi], 0
jne 0xdcc25e
cmp dword [edi + 0x10], 0
je 0xdcc2c4
push ebp
lea edx, [ebp]
xchg ebp, edi
mov edi, dword [ebp + 0x10]
xchg ebp, edi
add ebp, esi
cmp dword [ebp], 0
je 0xdcc2c4
xchg ecx, ebp
mov ebp, dword [ecx]
xchg ecx, ebp
lea esp, [esp - 4]
mov dword [esp], eax
push edx
or ecx, ecx
jns 0xdcc292
push ecx
jmp 0xdcc29b
add ecx, esi
add ecx, 2
push ecx
lea esp, [esp - 4]
mov dword [esp], eax
call dword [edx + 0x7b8e20]
mov edx, dword [esp]
lea esp, [esp + 4]
mov dword [ebp], eax
mov eax, dword [esp]
lea esp, [esp + 4]
add ebp, 4
jmp 0xdcc26b
pop ebp
add edi, 0x14
jmp 0xdcc206
push esp
push dword fs:[0]
push 0x9cc3f3
lea esp, [esp - 4]
mov dword [esp], ebp
push esi
xchg esi, eax
mov esi, dword [eax + 0x3c]
xchg esi, eax
mov eax, dword [eax + esi + 0x28]
add eax, esi
jmp eax

Function at 0xdcbe74
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
shr ecx, 2
xor dword [edx], eax
add edx, 4
dec ecx
jne 0xdcbe8e
mov ebp, dword [esp]
lea esp, [esp + 4]
ret 0xc
Function at 0xdcbf55
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebp
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0xdcbf86
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdcbf64
add dl, dl
jne 0xdcbf99
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdcc009
xor eax, eax
add dl, dl
jne 0xdcbfae
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdcc0de
add dl, dl
jne 0xdcbfc1
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdcbfd0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdcbfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdcbfee
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xdcbffc
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xdcbf79
mov eax, 1
add dl, dl
jne 0xdcc01b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdcc02a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdcc00e
sub eax, ebx
mov ebx, 1
jne 0xdcc071
mov ecx, 1
add dl, dl
jne 0xdcc04f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdcc05e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdcc042
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdcbf79
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xdcc08c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdcc09b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdcc07f
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdcbf79
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xdcc106
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xdcbf79
pop ebp
sub edi, dword [ebp + 8]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1e7a7500
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 4], 0x1e7ba2c0
je 0x1e7a751c
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
ret 8
mov eax, dword [eax + 8]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [esp + 8]
cmp ecx, 2
jne 0x1e7a7541
test eax, eax
je 0x1e7a754a
mov eax, dword [sym.imp.python27.dll__Py_TrueStruct]
inc dword [eax]
ret 8
cmp ecx, 3
jne 0x1e7a7554
test eax, eax
je 0x1e7a7537
mov eax, dword [sym.imp.python27.dll__Py_ZeroStruct]
inc dword [eax]
ret 8
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
ret 8

Function at 0x1e7a7ec6
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1e7a7f01
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1e7a7ee8
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1e7a7ef9
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1e7a7f03
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1e7a7ede
invalid
xor eax, eax
pop edi
pop esi
ret

Function at 0x1e7a7f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
outsb dx, byte [esi]
cmp byte [edi], 0x98
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x3c]
add esi, edi
mov ebx, dword [esi + 0x78]
call fcn.1e7a7e86
test eax, 0x5673cad5
push ebx
call fcn.1e7a7ec6
pop ecx
test eax, eax
pop ecx
je 0x1e7a8019
push edi
push esi
push ebx
call fcn.1e7a7f06
add esp, 0xc
call fcn.1e7a7e86
invalid
Function at 0x1e7a81d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.1e7a7e4b
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.1e7a7e86
shl dl, 0x67
push cs
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1e7a7e96
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a7e4b
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1e7a7e96
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a7e4b
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a7e96
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a7e4b
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a7e86
mov eax, dword gs:[0x9d88d76e]
jl 0x1e7a830b
invalid
invalid

Function at 0x1e7a8500
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1e7a853a
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
dec ebp
or byte [ebx], bh
retf 0x3f73
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
add al, dh
add byte [eax], al
add al, dh
add byte [eax], al
cmp edx, 0x3000
jne 0x1e7a851f
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1e7a8527
cmp edx, ebx
jne 0x1e7a8675
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1e7a84f6
add eax, dword [eax + 4]
jmp 0x1e7a84e3
mov dword [ebp + 0xc], ebx
jmp 0x1e7a8545
Function at 0x1e7a8570
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov ebp, 0xffffff78
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a855d
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a857b
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add byte [ebp + 0xf8c784], cl
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
invalid
invalid

Function at 0x1e7a85b0
Capabilities:
Inspect section memory permissions

Disassembly:
adc byte [eax], al
add byte [eax], al
or byte [ebx - 0x2cc4e7b3], 0x74
add al, 0x80
or al, 8
add dword [ecx], edi
cmp dword [ebp + 8], ebx
je 0x1e7a85c9
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a85d3
add ecx, eax
or byte [ecx], 4

Function at 0x1e7a85c0
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je sym.pywintypes27.dll_public:_static_struct__object____cdecl_PyTime::intFunc_struct__object__
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a85c9
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a85d3
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a85b5
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
invalid
jmp dword [esi - 0x75]
dec ebp
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x1e7a853f
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
invalid
je 0x1e7a8626
dec eax
je 0x1e7a861d
sub eax, 3
je 0x1e7a8614
mov dword [ebp - 4], 0x40
jmp 0x1e7a8643
mov dword [ebp - 4], 4
jmp 0x1e7a8629
mov dword [ebp - 4], 0x20
jmp 0x1e7a8629
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1e7a8675
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
push dword [esi - 0x60]
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax

Function at 0x1e7a86d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
clc
and byte [ebp - 0x354], 0
and byte [ebp - 0x353], 0
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
jne 0x1e7a8698
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi
jne 0x1e7a8698
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
invalid
invalid
invalid
cld
invalid

Function at 0x1e7a8760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
invalid
invalid
nop
Function at 0x1e7a89b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax - 0x4f000007], esp
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94

Function at 0x1e7a89e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.1e7a7e96
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a7e4b
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
invalid
movsd dword es:[edi], dword [esi]
invalid
cli

Function at 0x1e7a8a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a7e4b
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.1e7a7e86
inc ecx
inc bp
in eax, dx
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
dec edi
Function at 0x1e7a8af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec edi
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.1e7a7e96
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a7e4b
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.1e7a7e86
inc edx
mov dl, 0xe1
shr byte [eax + 4], 1
add byte [eax], al
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x1e7a8b7a
cmp dword [ebp - 0x398], 0
je 0x1e7a8d44
cmp dword [ebp + 0xc], 1
je 0x1e7a8d44
cmp dword [ebp + 0xc], 8
jne 0x1e7a8d0c
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.1e7a7e96
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a7e4b
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
invalid
call fcn.1e7a7e86
mov dl, 0xcc
jl 0x1e7a8cc6
and byte [ebp - 0x544], 0
push 0
call dword [ebp - 0x340]
sar ah, 0xff
dec dword [ecx + 0x4680845]
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax + 0x6a]
add bh, bh
xchg ebp, eax
enter 0xfffffffffffffffa, 0xffffffffffffffff
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
inc dword [eax]
Function at 0x1e7a8d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1e7a7e64
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
invalid
invalid
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x28600fbd
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x698c0915
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4fac09
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi

Function at 0x52a4ae
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
jmp 0x52a492
sub esp, 3
inc edx
mov edx, 0x3ce1a565
lea esp, [esp + 3]
xor edx, edx
jmp 0x52a46b
lea esp, [esp + 8]
div ecx
movzx eax, ax
pushal
jmp 0x52a51f
jmp 0x52a481
mov dword [ebp - 4], eax
lea esp, [esp + 0x20]
jmp 0x4fa273

Function at 0x52c8fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
jmp 0x52c951
mov ecx, dword [ebp + 0x18]
jmp 0x52cc3f
mov eax, dword [ebp + 8]
mov di, cx
mov ch, byte [esp]
jmp 0x52ca36
lea esp, [esp + 8]
js 0x52c50d
jmp 0x52c8e7
mov edx, ebp
jmp 0x52c967
lea esp, [esp + 4]
lea esi, reloc.WSOCK32.dll___WSAFDIsSet
stc
push edx
jmp 0x52c92c
mov eax, dword [ebp + ebx*4 - reloc.WSOCK32.dll___WSAFDIsSet]
jmp 0x52c4ec
add edx, 0xfffffff0
mov dword [edx], eax
pop edx
jmp 0x52c4e5
sub eax, ecx
push ax
mov byte [esp], ch
lea esp, [esp + 2]
jmp 0x52c942
mov ecx, edx
mov ecx, dword [esp]
mov cx, 0xfebb
lea ecx, reloc.WSOCK32.dll___WSAFDIsSet
pushfd
jmp 0x52c9a3
lea edi, reloc.WSOCK32.dll___WSAFDIsSet
mov ch, byte [esp]
dec ch
add esi, ebx
jmp 0x52c9f5
jbe 0x52c539
lea eax, [ebp*4]
mov eax, edi
jmp 0x52cc7e
push esp
lea esp, [esp + 4]
test ecx, ecx
jmp 0x52cc29
mov eax, 0x4192b6c6
mov edi, dword [ebp + 0xc]
xor eax, eax
call fcn.0052cc68