joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51f798
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406ae0
xor eax, eax
push ebp
push 0x51f7fc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x1c
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
call fcn.00406b84
push eax
call sub.kernel32.dll_GetVolumeInformationW
mov edx, ebx
lea eax, [ebp - 0x28]
call fcn.00414e24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51f803
lea eax, [ebp - 4]
call fcn.00406ae8
ret

Function at 0x521e44
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406ae0
xor eax, eax
push ebp
push 0x521f40
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xc]
call fcn.0051f61c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0051dcc8
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00523618
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0051dc78
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00523690
lea eax, [ebx + 0x50]
call fcn.004060f4
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x521f47
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406af0
ret
Function at 0x521f50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406ae0
xor eax, eax
push ebp
push 0x52205c
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xa]
call fcn.0051f61c
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x52201f
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0051dcc8
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00523618
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0051dc78
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00523690
jmp 0x522031
xor edx, edx
mov eax, ebx
call fcn.00523618
xor edx, edx
mov eax, ebx
call fcn.00523690
lea eax, [ebx + 0x50]
call fcn.004060f4
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522063
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406af0
ret
Function at 0x528598
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x52870e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5286e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x216], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x216]
push eax
lea eax, [ebp - 0x21c]
mov edx, esi
call fcn.00406c64
lea eax, [ebp - 0x21c]
mov edx, 0x528728
call fcn.00406f0c
mov eax, dword [ebp - 0x21c]
call fcn.00406b84
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x528658
lea eax, [ebp - 0x216]
call fcn.00414ad4
mov ecx, eax
lea edx, [ebp - 0x216]
mov eax, ebx
call fcn.00406c34
jmp 0x528661
mov eax, ebx
xor edx, edx
call fcn.00406af8
cmp si, 0x61
jae 0x528683
lea edx, [ebp - 0x220]
mov eax, dword [ebx]
call fcn.0041a424
mov edx, dword [ebp - 0x220]
mov eax, ebx
call fcn.00406af8
jmp 0x52869d
lea edx, [ebp - 0x224]
mov eax, dword [ebx]
call fcn.0041a410
mov edx, dword [ebp - 0x224]
mov eax, ebx
call fcn.00406af8
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x230], eax
mov byte [ebp - 0x22c], 0x11
lea edx, [ebp - 0x230]
xor ecx, ecx
mov eax, 0x52873c
call fcn.00414f9c
mov edx, dword [ebp - 0x228]
mov eax, ebx
call fcn.00406af8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5286f0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x5345c4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x178]
mov edx, ebx
mov eax, edi
call fcn.00534894
mov esi, eax
mov dword [edi + 0x178], esi
and esi, 0xff
add dword [edi + 0x17c], esi
imul esi, dword [edi + 0x17c], 0x8088405
inc esi
mov dword [edi + 0x17c], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x180]
mov eax, edi
call fcn.00534894
mov dword [edi + 0x180], eax
pop edi
pop esi
pop ebx
ret

Function at 0x534638
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [esi + 0x118]
cmp byte [eax + 0x4c], 0
jne 0x53466c
mov edi, ecx
dec edi
test edi, edi
jl 0x53467d
inc edi
mov eax, esi
call fcn.0053461c
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, esi
call fcn.005345c4
inc ebx
dec edi
jne 0x534653
jmp 0x53467d
lea eax, [esi + 0x3c4]
push eax
push ecx
push ebx
call fcn.005193a4
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x53471c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00406638
xor eax, eax
push ebp
push 0x534792
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00534684
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.0053461c
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.005345c4
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x53475c
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534799
lea eax, [ebp - 4]
call fcn.004060f4
ret
Function at 0x535698
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x535885
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x535841
mov eax, dword [ebp - 4]
call fcn.00537a58
cmp ebx, eax
jge 0x535841
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
mov edx, ebx
call fcn.0051d3e4
mov edx, dword [0x51fef4]
call fcn.00405094
mov esi, eax
mov eax, esi
call fcn.00523508
test al, al
je 0x535837
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [esi + 0x50]
call fcn.004064c8
test eax, eax
jne 0x53582a
xor eax, eax
push ebp
push 0x535823
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.005366a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
call fcn.00438acc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, esi
call fcn.004066c8
mov eax, dword [ebp - 8]
call fcn.004066c0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x160]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00535c78
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x160]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53586f
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
test al, al
jne 0x535822
mov eax, dword [ebp - 4]
call fcn.00536724
ret
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x50]
call fcn.00406148
jmp 0x53586f
mov eax, dword [ebp - 8]
call fcn.004060f4
jmp 0x53586f
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00413c48
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x4298c8]
call fcn.00418764
call fcn.0040592c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53588c
lea eax, [ebp - 0x54]
call fcn.00406ae8
ret
Function at 0x5420c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
dec ecx
js 0x542111
lea eax, [ebp - 0x30]
cmp word [eax + 0x20], 3
je 0x5420f8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x5420e8
jmp 0x542111
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x5420f9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56087c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5608f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x41
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00406c64
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x560910
call fcn.00406fcc
mov eax, dword [ebp - 4]
call fcn.00406b84
push eax
call sub.kernel32.dll_GetDriveTypeW
add eax, 0xfffffffe
sub eax, 2
jae 0x5608d4
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp ebx, 0x5b
jne 0x56089a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5608fc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406af0
ret

Function at 0x560cf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x560df0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, 0x1a
call fcn.0055f354
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041a290
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x560e08
call fcn.00406fcc
push dword [ebp - 8]
lea ecx, [ebp - 0x14]
mov eax, dword [ebx + 0x4f4]
mov edx, 0x560e68
call fcn.004de6f4
push dword [ebp - 0x14]
push 0x560e8c
lea eax, [ebp - 4]
mov edx, 3
call fcn.004070b0
mov eax, dword [ebp - 8]
call fcn.0052cd94
test al, al
jne 0x560d73
mov eax, dword [ebp - 8]
call fcn.0052cd9c
xor eax, eax
push ebp
push 0x560dce
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x4fc]
call fcn.004144bc
mov eax, dword [ebp - 0x18]
push eax
push 0
mov eax, dword [ebx + 0x4fc]
mov ecx, dword [ebp - 4]
xor edx, edx
call fcn.0055f1d0
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406b84
push eax
push 0x560e98
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x560dd5
ret
Function at 0x561808
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00406ae0
xor eax, eax
push ebp
push 0x561945
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x57a0d8]
mov eax, dword [eax]
mov ecx, 0x561960
mov edx, 0x561974
call fcn.004df37c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x40]
dec eax
test eax, eax
jl 0x561922
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.004dc7c8
mov esi, eax
lea ecx, [ebp - 8]
mov edx, 0x561990
mov eax, esi
call fcn.004de6f4
mov eax, dword [ebp - 8]
test eax, eax
je 0x5618a0
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x5618a0
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004062e0
mov ebx, eax
test ebx, ebx
je 0x5618ab
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, 4
mov edx, 5
mov eax, dword [ebp - 8]
call fcn.004072d8
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406fcc
lea ecx, [ebp - 0xc]
mov edx, 0x5619b0
mov eax, esi
call fcn.004de6f4
push 5
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.004144bc
mov eax, dword [ebp - 0x1c]
call fcn.00406b84
push eax
mov eax, dword [ebp - 0xc]
call fcn.00406b84
push eax
mov eax, dword [ebp - 8]
call fcn.00406b84
push eax
push 0x5619c4
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteW
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x561867
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56194c
lea eax, [ebp - 0x1c]
call fcn.00406ae8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406af0
ret

Function at 0x562db0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x562e47
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00413640
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x562e60
call fcn.00406fcc
mov eax, dword [ebp - 4]
call fcn.0048167c
mov eax, dword [ebp + 8]
mov ebx, dword [eax - 4]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
call fcn.00406b84
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.004c5dcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x562e4e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406af0
ret
Function at 0x416080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
faddp st(6)
inc ebp
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00415d01
push eax
push esi
push dword [ebp + 8]
call fcn.00415cb6
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
pop ebp
xchg esp, eax
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00415d01
push eax
push esi
push dword [ebp + 8]
call fcn.00415cb6
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00415d01
push eax
push esi
push dword [ebp + 8]
call fcn.00415cb6
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00415cf1
sub eax, 0x88194814
popfd
jl 0x416176
invalid
invalid
Function at 0x4160b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
faddp st(6)
inc ebp
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00415d01
push eax
push esi
push dword [ebp + 8]
call fcn.00415cb6
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
pop ebp
xchg esp, eax
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00415d01
push eax
push esi
push dword [ebp + 8]
call fcn.00415cb6
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00415d01
push eax
push esi
push dword [ebp + 8]
call fcn.00415cb6
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00415cf1
sub eax, 0x88194814
popfd
jl 0x416176
invalid
invalid
Function at 0x4162c0
Capabilities:
Inspect section memory permissions

Disassembly:
test byte [ebx], bl
add al, byte [eax]
add byte [ebx + 0x488bbc45], cl
adc byte [ebx - 0x723cc500], cl
cmp al, 0x31
jne 0x4162d9
mov dword [ebp + 0x10], edi
jmp 0x4162de
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.00415cf1
inc esi
jo 0x41635a
mov eax, 0x8b10458b
add byte [ebx], bh
ret
cmp dword [eax], ebx
je 0x4163a5
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x4163a0
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x41638a
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x416392
cmp edx, ebx
jne 0x4164e0
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x416361
add eax, dword [eax + 4]
jmp 0x41634e
mov dword [ebp + 0xc], ebx
jmp 0x4163b0
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4163c8
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4163e6
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x416444
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x41642b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x416434
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x41643e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x416420
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4163aa
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x416491
dec eax
je 0x416488
sub eax, 3
je 0x41647f
mov dword [ebp - 4], 0x40
jmp 0x4164ae
mov dword [ebp - 4], 4
jmp 0x416494
mov dword [ebp - 4], 0x20
jmp 0x416494
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4164e0
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x416460
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00415cf1
add byte [ecx + 0x75ffe208], ch
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x4164ec
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00415d01
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.00415c62
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x417c69