joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034a8f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3f9c]
mov eax, 0x401c
call fcn.10039d10
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x3f98], eax
mov eax, dword [ebp + 0x3fa4]
push ebx
push esi
push edi
mov dword [ebp - 0x74], eax
xor esi, esi
xor eax, eax
mov ebx, 0xffe
mov dword [ebp - 0x78], esi
push ebx
mov word [ebp + 0x2f98], ax
lea eax, [ebp + 0x2f9a]
push esi
push eax
mov dword [ebp - 0x70], esi
call fcn.10039d40
xor eax, eax
push ebx
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push esi
push eax
call fcn.10039d40
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
push 0x20019
push esi
push 0x1006c9a0
mov edi, 0x800
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10034bf8
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x2f98]
push eax
push esi
jmp 0x10034be7
lea eax, [ebp + 0x2f98]
push eax
push 0x1006c9f8
push 0x1006c994
lea eax, [ebp - 0x68]
push edi
push eax
call fcn.10052b6b
add esp, 0x14
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x68]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10034bcf
push ebx
mov word [ebp + 0xf98], ax
lea eax, [ebp + 0xf9a]
push esi
push eax
call fcn.10039d40
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xf98]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push str.RuntimeLib
push dword [ebp - 0x7c]
mov dword [ebp - 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10034bcf
cmp dword [ebp - 0x6c], esi
jbe 0x10034bcf
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push 0x1006ca68
push dword [ebp - 0x7c]
mov dword [ebp - 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc dword [ebp - 0x70]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x2f98]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], edi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10034b31
mov ecx, dword [ebp - 0x74]
lea eax, [ebp + 0x1f98]
push eax
call fcn.10001309
mov ecx, dword [ebp + 0x3f98]
mov eax, dword [ebp - 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10039bc2
add ebp, 0x3f9c
leave
ret
Function at 0x1003626c
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3fc4]
mov eax, 0x4044
call fcn.10039d10
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x3fc0], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, 0xffe
push edi
mov word [ebp + 0x2fc0], ax
xor ebx, ebx
lea eax, [ebp + 0x2fc2]
push ebx
push eax
call fcn.10039d40
push ebx
push 1
mov esi, 0x800
lea eax, [ebp + 0x2fc0]
push esi
push eax
call fcn.10024738
add esp, 0x1c
test eax, eax
jne 0x100362d0
xor eax, eax
inc eax
jmp 0x10036426
lea eax, [ebp + 0x2fc0]
push eax
push str.11.241.2
call fcn.10052b6b
pop ecx
pop ecx
test eax, eax
jg 0x100362c8
xor eax, eax
push edi
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push ebx
push eax
call fcn.10039d40
push ebx
lea eax, [ebp + 0x2fc0]
push eax
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.1001c257
add esp, 0x1c
test eax, eax
je 0x100362c8
xor eax, eax
push edi
mov word [ebp + 0xfc0], ax
lea eax, [ebp + 0xfc2]
push ebx
push eax
call fcn.10039d40
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 0xfc0]
push esi
push eax
call fcn.10052b6b
push str._bin_ssvagent.exe
lea eax, [ebp + 0xfc0]
push esi
push eax
call fcn.10052b6b
push 0x3c
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.10039d40
xor eax, eax
push edi
mov word [ebp + 0x1fc0], ax
lea eax, [ebp + 0x1fc2]
push ebx
push eax
mov dword [ebp - 0x80], 0x3c
call fcn.10039d40
push str._high__jpisetup__register
lea eax, [ebp + 0x1fc0]
push esi
push eax
call fcn.10052b6b
add esp, 0x48
call fcn.1002d15b
mov dword [ebp - 0x74], str.runas
test eax, eax
jne 0x100363a1
mov dword [ebp - 0x74], str.open
lea eax, [ebp + 0xfc0]
mov dword [ebp - 0x70], eax
xor edi, edi
lea eax, [ebp + 0x2fc0]
inc edi
push eax
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x7c], 0x40
call fcn.1002debf
test eax, eax
pop ecx
lea eax, [ebp + 0x1fc0]
je 0x100363d5
push str.__new
jmp 0x100363da
push str.__old
push esi
push eax
call fcn.10052b6b
lea eax, [ebp + 0x1fc0]
mov dword [ebp - 0x6c], eax
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x10036424
mov dword [ebp - 0x44], edi
cmp dword [ebp - 0x48], ebx
je 0x10036424
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
push dword [ebp - 0x48]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp + 0x3fc0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10039bc2
add ebp, 0x3fc4
leave
ret
Function at 0x10036629
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xf94]
mov eax, 0x1014
call fcn.10039d10
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0xf90], eax
mov eax, dword [ebp + 0xf9c]
push esi
xor ecx, ecx
mov dword [ebp - 0x80], eax
mov word [eax], cx
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1006d208
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x78], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10036729
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x7c], esi
push esi
jmp 0x10036714
xor ecx, ecx
xor eax, eax
cmp dword [ebp - 0x74], esi
jbe 0x10036702
cmp word [ebp + eax*2 - 0x70], 0x2e
jne 0x100366ae
inc ecx
cmp ecx, 1
jg 0x100366b9
inc eax
cmp eax, dword [ebp - 0x74]
jb 0x100366a0
cmp ecx, 1
jle 0x10036702
lea eax, [ebp - 0x70]
push 0x1006d1fc
push eax
call fcn.10052b6b
pop ecx
pop ecx
test eax, eax
js 0x10036702
lea eax, [ebp - 0x70]
push eax
call fcn.10036485
pop ecx
test al, al
je 0x10036702
push dword [ebp - 0x80]
lea eax, [ebp - 0x70]
push eax
call fcn.10052b6b
pop ecx
pop ecx
test eax, eax
jle 0x10036702
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0xfa0]
push dword [ebp - 0x80]
call fcn.10052b6b
add esp, 0xc
inc dword [ebp - 0x7c]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x78]
mov dword [ebp - 0x74], 0x800
call edi
test eax, eax
je 0x10036697
pop edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0xf90]
xor ecx, ebp
pop esi
call fcn.10039bc2
add ebp, 0xf94
leave
ret
Function at 0x10036976
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push 0x10
mov eax, 0x100596c7
call fcn.10039bd1
and dword [ebp - 0x10], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10001309
mov edi, dword [ebp - 0x14]
xor eax, eax
mov byte [ebp - 4], 1
test edi, edi
je 0x100369a9
cmp dword [edi], eax
sete al
jmp 0x100369aa
inc eax
test al, al
je 0x100369b5
push 0x1006d109
jmp 0x100369da
test edi, edi
je 0x100369bd
mov eax, dword [edi]
jmp 0x100369bf
xor eax, eax
push eax
call fcn.10052b6b
pop ecx
test eax, eax
jne 0x10036a15
test edi, edi
je 0x100369d7
mov ecx, edi
call fcn.10028aad
jmp 0x100369d9
xor eax, eax
push eax
call dword [sym.imp.wsock32.dll_gethostbyname]
test eax, eax
je 0x10036ab7
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.wsock32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x18]
call fcn.1001060c
push eax
lea ecx, [ebp - 0x10]
call fcn.1000147f
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10036a2a
call fcn.10001441
jmp 0x10036a2a
cmp eax, 1
jne 0x10036ab7
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000147f
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10036a38
call fcn.10028aad
jmp 0x10036a3a
xor eax, eax
push eax
call dword [sym.imp.wsock32.dll_inet_addr]
push 2
mov dword [ebp - 0x1c], eax
push 4
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.wsock32.dll_gethostbyaddr]
mov esi, eax
test esi, esi
jne 0x10036a6c
test edi, edi
je 0x10036a63
mov ecx, edi
call fcn.10001441
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10036ac2
jmp 0x10036abd
mov ecx, dword [esi]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10036a73
sub eax, edi
push eax
push ecx
call fcn.10052b6b
pop ecx
pop ecx
push dword [esi]
lea ecx, [ebp - 0x18]
call fcn.1001060c
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10036a9b
call fcn.10001441
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10036aa7
call fcn.10001441
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10036ab3
call fcn.10001441
mov al, 1
jmp 0x10036ac4
test edi, edi
je 0x10036ac2
mov ecx, edi
call fcn.10001441
xor al, al
call fcn.10039c70
ret
Function at 0x100373b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.10039d10
push 0xffffffffffffffff
push 0x10059845
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x100c]
xor edi, edi
mov dword [ebp - 0x18], edi
xor eax, eax
push 0xffe
mov word [ebp], ax
lea eax, [ebp + 2]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.10039d40
mov eax, dword [ebp + 0x1010]
add esp, 0xc
cmp eax, edi
je 0x10037425
mov esi, dword [eax]
jmp 0x10037427
xor esi, esi
movzx eax, word [esi]
xor edx, edx
xor ecx, ecx
cmp ax, di
je 0x1003754c
cmp ax, 0x2e
jne 0x10037443
inc edx
cmp edx, 1
jg 0x10037456
inc ecx
movzx eax, word [esi + ecx*2]
cmp ax, di
jne 0x10037437
cmp edx, 1
jle 0x1003754c
push 0x1006d7bc
push esi
call fcn.10052b6b
pop ecx
pop ecx
test eax, eax
js 0x1003754c
push esi
call fcn.10036485
pop ecx
test al, al
je 0x1003754c
push 0x1006d7d8
lea ecx, [ebp - 0x14]
call fcn.10001309
push 0x1006d7d4
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1001060c
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp ecx, edi
je 0x100374b8
call fcn.10001441
push esi
lea ecx, [ebp - 0x10]
call fcn.10001309
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp ecx, edi
je 0x100374e1
call fcn.10001441
mov esi, dword [ebp - 0x14]
cmp esi, edi
je 0x100374ec
mov eax, dword [esi]
jmp 0x100374ee
xor eax, eax
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10037534
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push 0x1006d830
push dword [ebp - 0x18]
mov dword [ebp - 0x10], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10037534
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push eax
mov ecx, ebx
call fcn.10001309
cmp esi, edi
je 0x1003756c
mov ecx, esi
call fcn.10001441
jmp 0x1003756c
push str.1.3.1
push esi
call fcn.10052b6b
push esi
call fcn.10036485
add esp, 0xc
push 0x1006d10e
mov ecx, ebx
call fcn.1001060c
mov ecx, dword [ebp + 0x1010]
cmp ecx, edi
je 0x1003757b
call fcn.10001441
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.10039bc2
add ebp, 0x1004
leave
ret
Function at 0x10039bc2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10080f6c]
jne 0x10039bcc
repz ret
jmp fcn.10042bbc

Function at 0x10052b6b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10052b7a
pop dword [ebp - 0x24]
mov eax, 0xcf0c9a9
sub eax, 0xfceb9e2f
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x4658e
push 0
mov eax, 0xa372b3de
sub eax, 0x936d1146
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x4afc
mov edi, eax
mov esi, 0x100cd200
add esi, dword [ebp - 0x24]
mov ebx, 0x1b0a6b4e
add ebx, 0x74f1e19b
sub dword [ebp - 0xc], 0x4c428628
mov edx, dword [esi]
xor dword [ebp - 4], 0x7e1bcb32
sub edx, ebx
add dword [ebp - 0x10], ecx
mov dword [edi], edx
xor dword [ebp - 0x14], ebx
add edi, 0x1831be
sub edi, 0x1831ba
add esi, 0xdf046bba
sub esi, 0xdf046bb6
loop 0x10052bcd
add eax, 0x89eb2ead
sub eax, 0x89ea0fea
xor ebx, ebx
add ebx, eax
add eax, 0x2e2d7f47
add eax, 0xd1d280be
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x1005558b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10083640], 0
push esi
push edi
jne 0x10055501
call fcn.1005546d
test eax, eax
je 0x10055546
mov eax, dword [0x10083640]
cmp eax, 1
jne 0x10055522
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x10055546
jmp 0x10055588
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x10055588
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1005554a
xor eax, eax
jmp 0x10055588
mov eax, dword [esi]
push dword [0x10083640]
call edi
mov edi, eax
test edi, edi
je 0x1005556c
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x10055588
lea edi, [esi + 0xff0]
push esi
push dword [0x10083640]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x10055572
mov eax, esi
pop edi
pop esi
ret
jmp 0x100554ed
Function at 0x40ac9a
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40acb8
mov eax, 0x4f4d85
push eax
push 1
mov ebx, 0x45b9c0
call fcn.0045b3e0
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40ace2
mov eax, 0
jmp 0x40ad56
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x40ad43
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40ad2c
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40ad1b
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40ad0c
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4

Function at 0x413269
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
jmp 0x41327e
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push ebx
mov ebx, 1
mov ebx, 2
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 5
pop ebx
push edx
push ecx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, ds:[esi*4]
mov ecx, dword [eax + ecx]
xor ecx, 0x13c5d863
xor ecx, 0x9dded20
xor ecx, 0xcae98ca
xor ecx, 0x6d5e1ce0
xor ecx, 0x726b792d
xor ecx, 0x4a2816e3
xor ecx, 0x22d8be7c
xor ecx, 0x117af4d7
xor ecx, 0x7e44e305
xor ecx, 0x23ae5bd
xor ecx, 0x387e506
xor ecx, 0x22d4d260
xor ecx, 0x69ddbd11
xor ecx, 0x59436461
xor ecx, 0x7b0cfde4
xor ecx, 0x5579bc35
xor ecx, 0x76f0c774
xor ecx, 0x1e225b06
xor ecx, 0x3f71a05c
xor ecx, 0x412f1ba3
xor ecx, 0x2b758f3f
xor ecx, 0x434f183a
xor ecx, 0x7dbd0e8c
xor ecx, 0x657f6cbb
xor ecx, 0xcd26eaa
xor ecx, 0x7b18c8ab
xor ecx, 0x6a6ac70a
xor ecx, 0x5647bbfd
xor ecx, 0x28875d9a
nop
nop
nop
nop
nop
nop
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp esi, dword [ebp + 0xc]
jne 0x4132e4
pop esi
pop ecx
pop edx
nop
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x4133e7
mov esp, ebp
pop ebp
ret 8
Function at 0x4162b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
jmp 0x4162cc
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push ebx
mov ebx, 1
mov ebx, 2
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 5
pop ebx
push edx
push ecx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, ds:[esi*4]
mov ecx, dword [eax + ecx]
xor ecx, 0x716a2827
xor ecx, 0x6959c1c0
xor ecx, 0x28f336de
xor ecx, 0x4d162d17
xor ecx, 0x134e2a24
xor ecx, 0x58fcf0e4
xor ecx, 0x370fb15
xor ecx, 0x75af78d4
xor ecx, 0x79cf94cc
xor ecx, 0x344131e2
xor ecx, 0x3861dc20
xor ecx, 0x7c7f2869
xor ecx, 0x64c12a54
xor ecx, 0x1e762f4a
xor ecx, 0x2995208d
xor ecx, 0x7c7ee72b
xor ecx, 0xac7e4b4
xor ecx, 0xecab193
xor ecx, 0x53e5f13b
xor ecx, 0x3599dc68
xor ecx, 0xf942db2
xor ecx, 0x3aefec6f
xor ecx, 0x30619d5d
xor ecx, 0x4fb44460
xor ecx, 0x7c2fe5cf
xor ecx, 0x28875d9a
xor ecx, 0x5647bbfd
xor ecx, 0x6a6ac70a
xor ecx, 0x7b18c8ab
nop
nop
nop
nop
nop
nop
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp esi, dword [ebp + 0xc]
jne 0x416332
pop esi
pop ecx
pop edx
nop
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x416435
mov esp, ebp
pop ebp
ret 8
Function at 0x41b40b
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x41b658
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x41b555
cmp byte [edx + edi], 0xd
jne 0x41b555
cmp byte [edx + edi + 1], 0xa
je 0x41b58e
mov al, byte [edx + edi]
cmp al, 0xa
je 0x41b58e
cmp al, 0x3d
jne 0x41b56a
inc ecx
cmp ecx, 2
ja 0x41b666
cmp al, 0x7f
ja 0x41b666
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x41b666
cmp al, 0x40
jae 0x41b58d
test ecx, ecx
jne 0x41b666
inc esi
inc edx
cmp edx, ebx
jb 0x41b53f
test esi, esi
je 0x41b658
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x41b677
cmp dword [ecx], eax
jb 0x41b677
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x41b647
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x41b643
cmp al, 0xa
je 0x41b643
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x41b643
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x41b62e
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x41b63b
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x41b643
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x41b5df
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x429e12
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x429ec5
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x43106a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43108d
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43108d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x431097
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4310d9
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43113b
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x431136
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x431121
test dl, dl
je 0x43111d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x431121
add ecx, 2
add eax, 2
test dl, dl
jne 0x431101
xor eax, eax
jmp 0x431126
sbb eax, eax
or eax, 1
test eax, eax
je 0x431147
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4310ee
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4311cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4311ef
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4311ef
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4311f9
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43123b
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43129d
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x431298
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x431283
test dl, dl
je 0x43127f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x431283
add ecx, 2
add eax, 2
test dl, dl
jne 0x431263
xor eax, eax
jmp 0x431288
sbb eax, eax
or eax, 1
test eax, eax
je 0x4312a9
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x431250
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8