joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45026a
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4a799c], 0
push ebx
push esi
mov esi, 0x4a79a4
jne 0x450296
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x4a79bc], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4a799c], 1
push dword [0x4a79bc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x450333
push 0x14
push 8
push dword [0x4a6b80]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x45035d
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4a79a0]
test eax, eax
je 0x4502d8
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4a79a0], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x450362
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x4a79bc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x4a6b80]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x45035d
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x450890
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4508bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4508bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x455c31
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00450750
mov eax, dword [0x4a6224]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00412500
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x455c73
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x455dcf
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004509a0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4a7330]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00413d8f
mov ecx, dword [esi*4 + 0x4a7330]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x455dc8
cmp eax, dword [ecx + edi + 0x24]
jne 0x455dc8
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x455dc8
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00413d8f
add esp, 0x14
test edx, edx
jl 0x455dc8
jg 0x455d3e
test eax, eax
jb 0x455dc8
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x455dc8
jl 0x455d58
cmp dword [ebp - 0x1008], eax
ja 0x455dc8
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x455d76
test ebx, ebx
je 0x455daf
cmp ecx, edi
jae 0x455daf
mov al, byte [ecx]
cmp al, 0xd
jne 0x455d90
lea eax, [edi - 1]
cmp ecx, eax
jae 0x455d9c
cmp byte [ecx + 1], 0xa
jne 0x455d9c
inc ecx
jmp 0x455d9c
movzx eax, al
movsx eax, byte [eax + 0x4a6988]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x455d76
cmp edx, ebx
jne 0x455d76
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x455dcd
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00405dd5
leave
ret
Function at 0x461b88
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x188
push 8
push dword [0x4a6b80]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x4a7b24]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x4a7b20], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.00464bf5
mov dword [esi + 0x58], 0x462a8d
mov eax, esi
mov dword [esi + 0x5c], 0x462ad9
mov dword [esi + 0x10], fcn.004625e7
mov dword [esi + 0x30], 0x4623d0
mov dword [esi + 0x64], 0x462b6e
mov dword [esi + 0x60], 0x462b22
mov dword [esi + 0x34], 0x461f49
mov dword [esi + 0x24], 0x461f20
mov dword [esi + 0x28], 0x461ef5
mov dword [esi + 0x2c], 0x461e49
mov dword [esi + 0x44], 0x462882
mov dword [esi + 0x68], 0x461c49
mov dword [esi + 0x6c], 0x462d70
pop esi
ret 4
Function at 0x467029
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul ecx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ecx
test ebx, ebx
je 0x4670fb
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x28]
imul edx, dword [esp + 0x1c], 3
push ebp
mov ebp, dword [esp + 0x24]
push esi
imul esi, dword [esp + 0x2c], 3
add eax, dword [esp + 0x1c]
push edi
mov dword [esp + 0x14], edx
add esi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], esi
mov edi, dword [eax + 0xcc]
imul edi, ebp
mov dword [esp + 0x28], esi
add edi, dword [eax + 0xc8]
add edi, edx
test ecx, ecx
jle 0x4670cf
mov ebp, dword [esp + 0x28]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov esi, ecx
movzx eax, byte [ebp]
imul eax, dword [esp + 0x40]
movzx ecx, byte [edi]
imul ecx, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [edi], al
inc edi
sub esi, 1
jne 0x467095
mov esi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x4670e8
sub esi, dword [esp + 0x24]
jmp 0x4670ec
add esi, dword [esp + 0x24]
mov dword [esp + 0x38], esi
test ebx, ebx
jne 0x46706d
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28

Function at 0x46771d
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x4677c9
imul eax, dword [esp + 0x1c]
imul ecx, dword [esp + 0x24], 3
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
add eax, dword [esp + 0x1c]
add ecx, eax
mov eax, dword [esp + 0x24]
mov edx, dword [edi + 0xcc]
mov ebp, ecx
imul edx, ebx
add edx, dword [edi + 0xc8]
add edx, eax
cmp dword [esp + 0x34], 0
jle 0x4677aa
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [edx + 2], al
mov al, byte [ebp + 1]
xor byte [edx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [edx], al
add edx, edi
sub esi, 1
jne 0x467783
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x38], esi
jne 0x4677bf
sub ecx, dword [esp + 0x20]
jmp 0x4677c3
add ecx, dword [esp + 0x20]
test esi, esi
jne 0x467761
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret 0x24
Function at 0x467c4f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov edx, dword [esp + 0x28]
test edx, edx
je 0x467e5f
mov ecx, dword [esp + 0x10]
imul ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
imul esi, dword [esp + 0x20], 3
add ecx, dword [esp + 0x18]
push edi
mov edi, 0xff
cmp dword [esp + 0x3c], edi
jne 0x467d6d
lea ebp, [ecx + eax*4]
mov dword [esp + 0x3c], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], eax
mov ebx, dword [ecx + 0xcc]
imul ebx, eax
mov dword [esp + 0x2c], ebp
add ebx, dword [ecx + 0xc8]
add ebx, esi
cmp dword [esp + 0x34], 0
jle 0x467d3f
mov eax, dword [esp + 0x34]
mov dword [esp + 0x30], eax
movzx edi, byte [ebp + 3]
mov esi, 0xff
movzx eax, byte [ebp + 2]
sub esi, edi
movzx ecx, byte [ebx + 2]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebx + 1]
mov byte [ebx + 2], al
movzx eax, byte [ebp + 1]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebx + 1], al
movzx eax, byte [ebx]
movzx ecx, byte [ebp]
lea ebp, [ebp + 4]
imul eax, esi
imul ecx, edi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
sub dword [esp + 0x30], 1
mov byte [ebx], al
lea ebx, [ebx + 3]
jne 0x467cc4
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x3c]
dec edx
inc eax
cmp dword [ecx + 0xe8], 0
mov dword [esp + 0x38], edx
mov dword [esp + 0x1c], eax
jne 0x467d58
sub ebp, dword [esp + 0x20]
jmp 0x467d5c
add ebp, dword [esp + 0x20]
mov dword [esp + 0x24], ebp
test edx, edx
jne 0x467c9c
jmp 0x467e5b
lea ebx, [ecx + eax*4]
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], eax
mov ebp, dword [ecx + 0xcc]
imul ebp, eax
mov dword [esp + 0x2c], ebx
add ebp, dword [ecx + 0xc8]
add ebp, esi
cmp dword [esp + 0x34], 0
jle 0x467e32
mov eax, dword [esp + 0x34]
mov dword [esp + 0x30], eax
movzx eax, byte [ebx + 3]
mov esi, 0xff
imul eax, dword [esp + 0x3c]
movzx ecx, byte [ebp + 2]
cdq
idiv edi
mov edi, eax
movzx eax, byte [ebx + 2]
imul eax, edi
sub esi, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
movzx ecx, byte [ebp + 1]
mov byte [ebp + 2], al
movzx eax, byte [ebx + 1]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov byte [ebp + 1], al
movzx eax, byte [ebp]
movzx ecx, byte [ebx]
lea ebx, [ebx + 4]
imul eax, esi
imul ecx, edi
mov edi, 0xff
add eax, ecx
cdq
idiv edi
sub dword [esp + 0x30], 1
mov byte [ebp], al
lea ebp, [ebp + 3]
jne 0x467dac
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
dec edx
inc eax
cmp dword [ecx + 0xe8], 0
mov dword [esp + 0x38], edx
mov dword [esp + 0x1c], eax
jne 0x467e4b
sub ebx, dword [esp + 0x20]
jmp 0x467e4f
add ebx, dword [esp + 0x20]
mov dword [esp + 0x24], ebx
test edx, edx
jne 0x467d84
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x28
Function at 0x46888d
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x468939
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
add ecx, dword [esp + 0x18]
push ebp
lea edx, [ecx + eax*4]
mov eax, dword [esp + 0x24]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x34], 0
jle 0x46891a
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, edi
sub esi, 1
jne 0x4688f3
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x38], esi
jne 0x46892f
sub edx, dword [esp + 0x20]
jmp 0x468933
add edx, dword [esp + 0x20]
test esi, esi
jne 0x4688d1
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret 0x24
Function at 0x46a6e5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
lea eax, [esp + 0x10]
push ebx
push esi
push eax
push dword [esp + 0x78]
xor esi, esi
mov ebx, esi
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x46a87c
push dword [esp + 0x28]
call fcn.00422adb
test eax, eax
je 0x46a725
push dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x46a87c
push edi
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x46a869
push ebp
mov ebp, dword [sym.imp.GDI32.dll_GetObjectW]
lea eax, [esp + 0x34]
push eax
push 0x18
push dword [esp + 0x38]
call ebp
cmp eax, 0x18
jne 0x46a861
push 0x2c
lea eax, [esp + 0x50]
push esi
push eax
call fcn.00414e60
mov eax, dword [esp + 0x44]
add esp, 0xc
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x54], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x50], 0x28
mov word [esp + 0x5c], ax
pop eax
push esi
push esi
mov word [esp + 0x62], ax
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x5c]
mov dword [esp + 0x6c], esi
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x46a861
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push edi
call esi
push 2
xor eax, eax
push eax
push eax
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x90]
push eax
push eax
push edi
call dword [sym.imp.USER32.dll_DrawIconEx]
push dword [esp + 0x2c]
push edi
call esi
lea eax, [esp + 0x34]
push eax
push 0x18
push dword [esp + 0x38]
call ebp
cmp eax, 0x18
jne 0x46a861
mov ebp, dword [esp + 0x38]
xor esi, esi
mov edx, dword [esp + 0x3c]
mov eax, ebp
shl eax, 2
mov dword [esp + 0x10], eax
test edx, edx
jle 0x46a861
mov eax, dword [sym.imp.GDI32.dll_GetPixel]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov ecx, edx
sub ecx, esi
add eax, 3
dec ecx
xor ebx, ebx
imul ecx, dword [esp + 0x10]
add eax, ecx
mov dword [esp + 0x7c], eax
test ebp, ebp
jle 0x46a858
push esi
push ebx
push edi
call dword [esp + 0x24]
mov ecx, dword [esp + 0x7c]
test eax, eax
setne al
dec al
mov byte [ecx], al
add ecx, 4
mov ebp, dword [esp + 0x38]
inc ebx
mov dword [esp + 0x7c], ecx
cmp ebx, ebp
jl 0x46a830
mov edx, dword [esp + 0x3c]
inc esi
cmp esi, edx
jl 0x46a813
mov ebx, dword [esp + 0x1c]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop ebp
push dword [esp + 0x28]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [esp + 0x2c]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x68
ret 4
Function at 0x405e80
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x240
lea eax, [esp + 0x13c]
push ebx
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x148]
push str.svchost.exe
push ecx
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x405f83
lea edx, [esp + 0x148]
push 0x409eb0
push edx
call sub.MSVCRT.dll_fopen
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x405f83
lea eax, [esp + 0xc]
lea ecx, [esp + 0x68]
push eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
push ebx
call fcn.00405830
add esp, 0x14
test al, al
je 0x405f6b
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x68]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.00405970
add esp, 0x10
mov edi, eax
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x405f83
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 0x6c]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
push ebx
call fcn.00405a00
mov eax, dword [esp + 0x24]
push edi
push esi
lea ecx, [esp + 0x88]
push eax
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x50]
push edx
push eax
call fcn.00405c90
add esp, 0x30
push ebx
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x240
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x240
ret
Function at 0x68f195c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
invalid
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.68f192c9
or esp, ebx
jp 0x68f19599
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x68f19bac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
invalid
test dword [esi - 4], ecx

Function at 0x68f19f86
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x68f19fbd
cmp dword [ebp - 0x398], 0
je 0x68f1a187
cmp dword [ebp + 0xc], 1
je 0x68f1a187
cmp dword [ebp + 0xc], 8
jne 0x68f1a14f
invalid

Function at 0x68f19fe3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.68f192d9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.68f1928e
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
invalid
invalid
inc esp
Function at 0x68f1a1d7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ebp - 0x50243], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.68f192a7
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [0x3cfffffc], al
Function at 0x4029e0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402a0f
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403db4
jmp 0x402a2d
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402968
mov edi, eax
test ebx, ebx
je 0x402a2d
cmp dword [esi], 0
je 0x402a2d
dec ebx
jmp 0x402a16
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402c9c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x504044], 0x8088405
inc edx
mov dword [0x504044], edx
mul edx
mov eax, edx
ret

Function at 0x402df4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402e8c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402e6c
xor eax, eax
push ebp
push 0x402e65
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ea8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e6c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403c80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027a4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x504049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403c48
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc