joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x86b1f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea ebp, [esp + 0x28]
btr di, sp
sub esp, 0x98
bswap di
jmp 0x86b677
pushal
sub esi, 0x29a53fcd
mov di, dx
rol ebp, cl
ror ebp, cl
ror esi, 0x16
neg bp
jmp 0x86a68f
Function at 0x405d96
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dcd
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405da7
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dfe
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de0
pop edi
not eax
pop esi
ret 0xc

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.00401507
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x401005
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x401a00
sub esp, 0x190
xor ecx, ecx
mov ch, byte [esp + 0x198]
lea eax, [esp]
push ebx
mov bl, byte [esp + 0x198]
mov cl, bl
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x401a52
mov ax, word [esp + 4]
xor edx, edx
mov dl, ah
cmp dl, bl
jne 0x401a4c
cmp al, byte [esp + 0x19c]
jne 0x401a4c
mov eax, 1
pop ebx
add esp, 0x190
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop ebx
add esp, 0x190
ret

Function at 0x40101e
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
jmp 0x401910
sub esp, 0x10
push 2
push 2
call fcn.00401005
add esp, 8
test eax, eax
jne 0x401927
add esp, 0x10
ret
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x40fd24], eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], eax
push ecx
mov word [esp + 4], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 2], ax
mov eax, dword [0x40fd24]
lea edx, [esp]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x40197b
xor eax, eax
add esp, 0x10
ret
mov ecx, dword [0x40fd24]
push ecx
call fcn.0040102d
add esp, 4
mov eax, 1
add esp, 0x10
ret

Function at 0x40102d
Capabilities:
Set socket configuration

Disassembly:
jmp 0x4019d0
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop ecx
ret
Function at 0x401037
Capabilities:
Hide graphical window

Disassembly:
jmp 0x4012a0
sub esp, 0x20
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push esi
push edi
mov edi, dword [esp + 0x30]
push 0
mov dword [0x40fd00], edi
call ebx
sub eax, 0x320
push 1
cdq
sub eax, edx
mov esi, eax
sar esi, 1
call ebx
sub eax, 0x258
push 0
cdq
push edi
sub eax, edx
push 0
push 0
sar eax, 1
push 0x258
push 0x320
push eax
push esi
push connect
push 0x40cb00
push 0x40ca30
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov edi, eax
test edi, edi
jne 0x40130b
pop edi
pop esi
pop ebx
add esp, 0x20
ret
mov esi, dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
push 0
push 0
push 0
push str.imageWebshots_17021.bmp
push 0
mov dword [0x40fd04], edi
call esi
push 0x10
push 0
push 0
push 0
push str.image_bgmap1.bmp
push 0
mov dword [0x40fcfc], eax
call esi
push 0x10
push 0
push 0
push 0
push str.image_bgmap0.bmp
push 0
mov dword [0x40fcd0], eax
call esi
push 0x10
push 0
push 0
push 0
push str.imagemmtimebox.bmp
push 0
mov dword [0x40fcd4], eax
call esi
push 0x10
push 0
push 0
push 0
push str.imagemmbox.bmp
push 0
mov dword [0x40fd0c], eax
call esi
push 0x10
push 0
push 0
push 0
push str.imagegirlsgirls_0001_.bmp
push 0
mov dword [0x40fcf4], eax
call esi
push 0x10
push 0
push 0
push 0
push str.image_time.bmp
push 0
mov dword [0x40fccc], eax
call esi
push edi
mov dword [0x40fcdc], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov dword [0x40fcc8], eax
call esi
mov dword [0x40fcd8], eax
mov eax, dword [0x40fcc8]
push eax
call esi
mov ecx, dword [0x40fcc8]
push 0x258
push 0x320
push ecx
mov dword [0x40fd08], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov edx, dword [esp + 0x34]
mov dword [0x40fcc4], eax
push edx
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x40fcc4]
mov ecx, dword [0x40fcd8]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [0x40fcc8]
push edx
call fcn.00401050
mov al, byte [0x40fd20]
xor ecx, ecx
mov dword [esp + 0x11], ecx
push 0x40ca50
mov dword [esp + 0x19], ecx
push str.setup.ini
mov word [esp + 0x21], cx
mov byte [esp + 0x18], al
mov byte [esp + 0x23], cl
call fcn.00401fe0
mov esi, eax
lea edx, [esp + 0x24]
push esi
push 0x14
push 1
push edx
call fcn.00401ed8
push esi
call fcn.00401e82
push 0x40fce8
lea eax, [esp + 0x3c]
push 0x40ca40
push eax
call fcn.00401e4e
lea ecx, [esp + 0x38]
lea edx, [esp + 0x44]
push ecx
push str._s_s
push edx
call fcn.00401e4e
lea eax, [esp + 0x44]
push 0x17d4
push eax
mov byte [0x40fcf8], 0
call fcn.0040101e
add esp, 0x40
cmp eax, 1
jne 0x4014b3
mov byte [0x40fcf8], al
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret
Function at 0x401050
Capabilities:
Capture screenshot

Disassembly:
jmp 0x401550
mov eax, dword [0x40fcfc]
mov ecx, dword [0x40fd08]
push ebx
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ecx
call edi
mov edx, dword [0x40fd08]
mov eax, dword [0x40fcd8]
push 0xcc0020
mov esi, dword [sym.imp.GDI32.dll_BitBlt]
push 0
push 0
push edx
push 0x258
push 0x320
push 0
push 0
push eax
call esi
mov ecx, dword [0x40fcd4]
mov edx, dword [0x40fd08]
push ecx
push edx
call edi
mov eax, dword [0x40fd08]
mov ecx, dword [0x40fcd8]
push 0x8800c6
push 0
push 0
push eax
push 0x258
push 0x320
push 0
push 0
push ecx
call esi
mov edx, dword [0x40fcd0]
mov eax, dword [0x40fd08]
push edx
push eax
call edi
mov ecx, dword [0x40fd08]
mov edx, dword [0x40fcd8]
push 0xee0086
push 0
push 0
push ecx
push 0x258
push 0x320
push 0
push 0
push edx
call esi
mov eax, dword [0x40fd0c]
mov ecx, dword [0x40fd08]
push eax
push ecx
call edi
mov edx, dword [0x40fd08]
mov eax, dword [0x40fcd8]
push 0xcc0020
push 0
push 0
push edx
push 0x18d
push 0x13a
push 0x7c
push 0x18
push eax
call esi
mov ecx, dword [0x40fcf4]
mov edx, dword [0x40fd08]
push ecx
push edx
call edi
push 0xcc0020
push 0
push 0
mov eax, dword [0x40fd08]
mov ecx, dword [0x40fcd8]
push eax
push 0x110
push 0xd1
push 0x8c
push 0x4e
push ecx
call esi
mov edx, dword [0x40fccc]
mov eax, dword [0x40fd08]
push edx
push eax
call edi
mov ecx, dword [0x40fd08]
mov edx, dword [0x40fcd8]
push 0xcc0020
push 0
push 0
push ecx
push 0x10b
push 0xc8
push 0x8e
push 0x52
push edx
call esi
mov eax, dword [0x40fcdc]
mov ecx, dword [0x40fd08]
push eax
push ecx
call edi
xor ebx, ebx
mov edi, 0x5a
mov eax, dword [0x40fd08]
mov ecx, dword [0x40fcd8]
push 0x8800c6
lea edx, [ebx + 0x3b6]
push 0
push edx
push eax
push 0x6c
push 0x5f
push 0x19a
push edi
push ecx
call esi
mov edx, dword [0x40fd08]
mov eax, dword [0x40fcd8]
push 0xee0086
push 0
push ebx
push edx
push 0x6b
push 0x5f
push 0x198
push edi
push eax
call esi
add edi, 0x46
add ebx, 0x5f
cmp edi, 0x316
jl 0x4016bd
mov ecx, dword [0x40fcd8]
mov edx, dword [esp + 0x10]
push 0xcc0020
push 0
push 0
push ecx
push 0x258
push 0x320
push 0
push 0
push edx
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
mov dword [0x40fce4], eax
pop ebx
ret
Function at 0x67b2e7
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
add byte [eax], al
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x67b39b
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0067b277
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x67b374
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x67b3a7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x67b3c2
test ebp, ebp
je 0x67b3c2
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x67b3ca
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x67b40a
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x67b466
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x67b461
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x67b44c
test dl, dl
je 0x67b448
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x67b44c
add ecx, 2
add eax, 2
test dl, dl
jne 0x67b42c
xor eax, eax
jmp 0x67b451
sbb eax, eax
or eax, 1
test eax, eax
je 0x67b470
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x67b419
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x67b487
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0067b2e7
test eax, eax
jne 0x67b49f
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0067b3a7
mov esi, eax
test esi, esi
jne 0x67b4d5
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x67b4ef
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x67b5e7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0067b2e7
mov esi, eax
test esi, esi
jne 0x67b605
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0067b3a7
mov dword [esp + 0x18], eax
test eax, eax
je 0x67b5fd
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0067b3a7
mov dword [esp + 0x34], eax
test eax, eax
je 0x67b5fd
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0067b3a7
mov dword [esp + 0x28], eax
inc esp
and al, 0x28
test eax, eax
je 0x67b5fd
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0067b3a7
mov dword [esp + 0x30], eax
test eax, eax
je 0x67b5fd
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x67b7cc
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x67b7cc
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x67b72f
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x67b7b0
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x67b752
movzx esi, ax
jmp 0x67b757
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x67b776
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x67b785
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x67b7d9
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x67b747
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x67b70c
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x67b802
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x67b802
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x67b7e7
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x67b817
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0067b2e7
mov esi, eax
test esi, esi
je 0x67b8d3
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0067b3a7
mov ebp, eax
test ebp, ebp
je 0x67b8d2
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0067b3a7
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x67b8d2
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x67b8d2
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x67b8d1
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x67b8b7
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret
Function at 0x7dab2c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07cbfd8
jmp 0x7dab66
pop word [esp]
lea esp, [esp + 3]
jmp 0x7dab9a
lea esi, [ecx + ebp]
jmp 0x7dab82
rdtsc
mov cl, bl
jmp 0x7dab50
cmc
jmp 0x7dac23
mov esi, dword [esp + 0x2c]
mov ch, byte [esp]
bsf ax, dx
jb 0x7dab6c
jae 0x7dacdb
and eax, 0x796ec754
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
pushfd
jmp 0x7daad1
rcr bl, 5
jno 0x7dabca
mov edx, dword [esp]
setge ah
cpuid
jmp 0x7dabff
cpuid
sub esp, 0xa0
mov edi, esp
jmp 0x7daba8
mov edx, dword [esp]
setge ah
jmp 0x7dabfd
jmp 0x7dabbe
push eax
push word [esp + 2]
lea esp, [esp + 2]
sub esp, 0x1d
jmp 0x7dac30
cpuid
mov edx, esi
sbb eax, 0x37de20e8
je 0x7dabe7
jne 0x7daca1
add ebx, 0xc10272f0
jmp 0x7dc557
lea ebp, [esp]
rdtsc
pushal
inc ecx
jno 0x7dabe5
cpuid
jmp 0x7dabc0
xchg byte [esp + 0x11], bl
rol eax, cl
pop ebx
mov cx, ax
setb bh
jmp 0x7dac65
sub esp, 0x1d
xchg byte [esp + 0x11], bl
jmp 0x7dac34
not al
xchg bx, ax
pop word [esp + 4]
lea esp, [esp + 3]
lea esp, [esp + 0x14]
call fcn.007dac7d
sub al, 0x8d
lea ecx, [eax*4]
add ebx, 0x5a844a39
jmp 0x7dc5bc
push eax
push word [esp + 2]
lea esp, [esp + 2]
jmp 0x7dac46
cmc
jmp 0x7dac23
mov ah, bh
mov eax, 0xed536905
bsr eax, edx
jo 0x7dc575
jno 0x7dc5b8
iretd
bswap eax
mov ebx, dword [ebx + reloc.MSVCRT.dll_strncpy]
lea eax, [edx + edi]
mov eax, ebp
mov eax, dword [esp]
jmp 0x7dc5a2
dec al
jg 0x7dc5d2
jle 0x7dac91
mov eax, dword [reloc.MSVCRT.dll_strncpy]
xchg byte [edi + ebx - 0x6cef6e9a], cl
bswap eax
jmp 0x7dc577
neg ah
js 0x7dc5ed
xor al, 0x34
cmp eax, edx
jmp 0x7dc5f1
jmp 0x7dac91
cmp eax, edx
jmp 0x7dc5f1
xor al, 0x34
jmp 0x7dc5d7
mov esp, edi
bt ax, bx
jo 0x7dca2b
mov ax, 0x545c
mov eax, ebx
jmp 0x7dca15
mov eax, ebx
mov eax, dword [esp]
jmp 0x7dca70
mov eax, dword [esp]
jmp 0x7dca70
mov ax, 0x545c
jmp 0x7dca0a
push ebx
ret

Function at 0x7dab43
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 5]
lea esp, [esp + 2]
mov dword [esp + 4], ebx
pushal
mov dword [esp + 0x20], esp
push word [esp + 3]
ja 0x7daae4
jbe 0x7daab8
Function at 0x7dd3c3
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xf07cbfd8
jmp 0x7dd45e
push ebx
ret
mov eax, esi
jmp 0x7dd2ae
bswap eax
bt ax, bp
jne 0x7dd2ed
mov eax, esi
jmp 0x7dd2ef
lea esp, [esp + 2]
xchg dword [esp + 8], edx
push esp
jmp 0x7dd3d2
lea edx, [edx + 0x30]
push si
lea esp, [esp + 2]
xchg dword [esp + 0xc], edx
call fcn.007dd478
arpl si, si
add edi, esi
dec ebp
mov ds, word [bx + di]
js 0x7dd44a
push word [esp + 6]
lea esp, [esp + 2]
jmp 0x7dd4fa
mov word [esp], di
push dword [esp + 3]
jmp 0x7dd450
push word [esp]
ja 0x7dd3fd
mov word [esp], di
push dword [esp + 3]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x7dd458
and al, 0x1c
push bx
jmp 0x7dd413
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
pushfd
jmp 0x7dcb1e
jmp 0x7dd49c
shr esi, cl
cmc
jmp 0x7dd4be
cmc
jmp 0x7dd4be
mov ebp, eax
bsf eax, ecx
jmp 0x7dd4cc
xchg cx, dx
bsf ebp, edi
jge 0x7dd460
shr esi, cl
jmp 0x7dd47f
mov ebp, eax
bsf eax, ecx
jmp 0x7dd4cc
mov esi, dword [esp + 0x2c]
pushal
sub eax, 0x1ea61002
jg 0x7dd482
jle 0x7dd4a8
lea ebp, [esp + 0x20]
bsr ebx, esi
jmp 0x7dd72c
xchg cx, ax
mov edx, 0x9cc8864d
mov eax, 0xeb7a75e0
jmp 0x7dd51c
mov esp, edi
mov eax, 0x40c61174
jmp 0x7dd34c
jmp 0x7dd552
sub esp, 0xa0
mov edi, esp
cmc
jae 0x7dd506
adc ebx, esi
xchg cl, bl
lea eax, [ebx*4]
jmp fcn.007dd538
mov eax, 0xeb7a75e0
jmp 0x7dd51c
js 0x7dd4d9
xchg cx, ax
mov edx, 0x9cc8864d
jmp 0x7dd593

Function at 0x7eb0d4
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x7cf30b
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x7cf325
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x7cf314
pop esi
jmp 0x7cf330
ret 4
pushfd
mov dword [esp + 0xd], ecx
push word [esp + 0x24]
mov dword [esp + 0x18], edi
push si
jmp 0x7eb11b
pop word [esp + 0x10]
lea esp, [esp + 2]
lea esp, [esp + 0x28]
jmp 0x7cf2fe

Function at 0x7eb296
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x7cfb96
pushfd
or dword [esp], reloc.MSVCRT.dll_strncpy
popfd
cpuid
nop
jmp 0x7cfbad
pop ebx
ret
mov edx, dword [esp + 0xc]
call fcn.007eb1d4
mov byte [esp + 1], bl
call fcn.007eb27f
test byte [ebx], ah
jg 0x7eb235
push ebp
fsub st(1)
cmp dword [ebp - reloc.MSVCRT.dll_strncpy], eax
das
and dword ss:[eax - 0x73], esp
and al, 4
jmp 0x7cfb8a

Function at 0xc9dd12
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + 6]
shr bx, 3
setg dl
mov dx, si
jmp 0xc9dd39
lea edi, [ecx*4]
add esp, 2
push word [esp + 8]
jmp 0xc9dce4
sub esp, 9
lea esp, [esp + 1]
lea esp, [esp + 0xc]
pushal
sub esp, 0x10
jmp 0xc9dcfa
xchg dword [esp + 7], ecx
xchg byte [esp + 0xa], al
xchg byte [esp + 4], cl
cld
jmp 0xc9dd6f
push word [esp + 0xd]
mov dword [esp + 0xc], esp
xchg word [esp + 0xd], ax
xchg dx, si
bsr ecx, esi
jmp 0xc9dd23
mov bp, 0x2ae7
bsr ax, si
stc
mov dword [esp + 5], ebx
rol edi, cl
mov dword [esp + 1], eax
jmp 0xc9dd59