joyce8/EMBER2024-capa huggingface dataset:
Function at 0x820869
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test ecx, ecx
jle 0x8209b9
mov dword [ebp - 8], ecx
push ebx
mov cl, byte [edi]
mov dl, byte [eax]
mov bl, cl
or cl, dl
xor bl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi]
mov dl, cl
or cl, byte [ebp - 4]
xor dl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi], cl
mov cl, byte [edi + 1]
mov dl, byte [eax + 1]
mov bl, cl
or cl, dl
xor bl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 1]
mov dl, cl
or cl, byte [ebp - 4]
xor dl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 1], cl
mov cl, byte [edi + 2]
mov dl, byte [eax + 2]
mov bl, cl
or cl, dl
xor bl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 2]
mov dl, cl
or cl, byte [ebp - 4]
xor dl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 2], cl
mov cl, byte [edi + 3]
mov dl, byte [eax + 3]
mov bl, cl
or cl, dl
xor bl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 3]
mov dl, cl
xor dl, byte [ebp - 4]
or cl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 3], cl
mov cl, byte [edi + 4]
mov dl, byte [eax + 4]
mov bl, cl
xor bl, dl
or cl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 4]
mov dl, cl
xor dl, byte [ebp - 4]
or cl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 4], cl
mov cl, byte [edi + 5]
mov dl, byte [eax + 5]
mov bl, cl
xor bl, dl
shr bl, 1
or cl, dl
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 5]
mov dl, cl
or cl, byte [ebp - 4]
xor dl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 5], cl
mov cl, byte [edi + 6]
mov dl, byte [eax + 6]
mov bl, cl
or cl, dl
xor bl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 6]
mov dl, cl
xor dl, byte [ebp - 4]
or cl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 6], cl
mov cl, byte [edi + 7]
mov dl, byte [eax + 7]
add edi, dword [ebp + 0x14]
add eax, dword [ebp + 0x18]
mov bl, cl
or cl, dl
xor bl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 7]
mov dl, cl
xor dl, byte [ebp - 4]
or cl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 7], cl
add esi, dword [ebp + 0x10]
dec dword [ebp - 8]
jne 0x820882
pop ebx
pop edi
pop esi
leave
ret
Function at 0x82160e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
mov edx, esi
push dword [ebp + 0xc]
mov eax, edi
push dword [ebp + 8]
call fcn.00821189
add esp, 0xc
lea edx, [esi + 8]
lea eax, [edi + 8]
pop ebp
jmp fcn.00821189
Function at 0x85cd88
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x85ce0d
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00865560
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x85cdd0
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x85cdf2
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x85ce68
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.0085cad6
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
pop ecx
pop ecx
cmp esi, 3
jb 0x85ce54
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x85ce68
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x85cd91
pop esi
pop ebx
leave
ret
Function at 0x8648b4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
cdq
and edx, 7
add eax, edx
push ebx
mov ebx, dword [esp + 0x10]
sar eax, 3
and ecx, 7
push esi
mov esi, ecx
test eax, eax
jle 0x8648fd
push edi
mov edi, eax
mov ecx, dword [esp + 0x10]
push 8
call fcn.00860b96
mov ecx, ebx
shr ecx, 8
movzx ebx, bl
xor eax, ecx
and eax, 0xff
shl ebx, 8
xor ebx, dword [eax*4 + 0x10380978]
dec edi
jne 0x8648d5
pop edi
test esi, esi
jle 0x86492b
mov ecx, dword [esp + 0xc]
push 1
call fcn.00860b96
mov ecx, ebx
shr ecx, 0xf
and ecx, 1
and ebx, 0x7fff
xor eax, ecx
add ebx, ebx
test eax, eax
je 0x864928
xor ebx, 0x8005
dec esi
jne 0x864901
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x94e4d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x25d000]
push edi
or ebp, 0xffffffff
jmp 0x94e4f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x94e4f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x94e4e8
mov eax, 1
add ebx, ebx
jne 0x94e50b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x94e500
jne 0x94e51c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x94e500
xor ecx, ecx
sub eax, 3
jb 0x94e530
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x94e5a2
mov ebp, eax
add ebx, ebx
jne 0x94e53b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x94e548
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x94e56c
inc ecx
add ebx, ebx
jne 0x94e558
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x94e54d
jne 0x94e569
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x94e54d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x94e58c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x94e57d
jmp 0x94e4ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x94e58c
add edi, ecx
jmp 0x94e4ee
pop esi
mov edi, esi
mov ecx, 0x47f7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x94e5aa
cmp byte [edi], 0x11
jne 0x94e5aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x94e5af
lea edi, [esi + 0x54b000]
mov eax, dword [edi]
or eax, eax
je 0x94e627
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5ae354]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5ae444]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x94e5dc
mov ecx, edi
jns 0x94e60b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5ae448]
or eax, eax
je 0x94e621
mov dword [ebx], eax
add ebx, 4
jmp 0x94e5f9
call dword [esi + 0x5ae458]
mov ebp, dword [esi + 0x5ae44c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x94e65b
sub esp, 0xffffff80
jmp 0x4a95d5
Function at 0x10006773
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.10005c6f
test al, ah
insb byte es:[edi], dx
sbb byte [eax - 0x6635b], al
inc dword [eax]
and byte [ebp - 0x663], 0
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.10005c7f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10005c34
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.10005c7f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10005c34
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.10005c6f
push edx
aaa
test al, 0x8f
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.10005c7f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10005c34
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.10005c6f
xchg ebx, eax
jmp fcn.1000696c

Function at 0x10006930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
inc dword [ecx]
cmp dword [ebp - 0x398], 0
je 0x10006963
cmp dword [ebp - 0x398], 0
je 0x10006b2d
cmp dword [ebp + 0xc], 1
invalid
test dl, cl
Function at 0x10006b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.10005c6f
or ebp, dword [ecx]
mov ch, 0xa5
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10005c4d
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
invalid
movsd dword es:[edi], dword [esi]
xchg edi, eax

Function at 0x10007610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 1], ch
pop eax
test eax, eax
je 0x10007d15
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4066ce
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4150d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp byte [ebx + 0x30], 0
jne 0x40675c
push 0x104
lea eax, [ebp - 0x210]
push eax
mov byte [ebx + 0x30], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40675c
push esi
push edi
lea edi, [ebp - 0x210]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x406710
push 6
pop ecx
lea eax, [ebp - 0x210]
mov esi, 0x4014c8
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
pop edi
pop esi
je 0x40675c
push 0x4014a4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebx + 0x2c], eax
je 0x40675c
push 0x401488
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41602c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00407c6f
leave
ret

Function at 0x407c6f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg esp, eax
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
inc ebp
cdq
sub dh, al
inc ebp
lcall 0xc635, 0x9b45c633
inc ebp
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6

Function at 0x407c83
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
cdq
sub dh, al
inc ebp
lcall 0xc635, 0x9b45c633
inc ebp
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
invalid
Function at 0x408120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.004078c3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407878
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004078c3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407878
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.004078c3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407878
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.004078b3
lodsd eax, dword [esi]
mov dh, 0xae
mov byte [eax - 0x5335b], al
inc dword [eax]
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.004078c3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407878
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.004078b3
std
invalid
Function at 0x40875f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push 0
call dword [ebp - 0x538]
call fcn.004078b3
outsb dx, byte [esi]
and ebx, ebp
les eax, [eax - 0x22f5b]
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00407891
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
test dword [ebx + 0x27fffffc], esp
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.004078c3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407878
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.004078b3
xor byte [ebx + 0x2a], ah
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.004078b3
sti
movsb byte es:[edi], byte [esi]
inc edi
mov byte [eax - 0x7fff1f9b], 0x65
loope 0x4088d5
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax

Function at 0x40942b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add eax, dword [eax]
add byte [ebx - 0x6fb43], al
inc dword [ecx]
Function at 0x408076
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a080]
jne 0x408080
repz ret
jmp fcn.00408abd

Function at 0x41170c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040a362
and dword [ebp - 0x14], 0
cmp dword [0x4ac3dc], 0
mov dword [ebp - 0x18], eax
jne 0x4117bf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411867
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x411867
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4ac3dc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4ac3e0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4ac3e4], eax
call edi
push eax
call esi
mov dword [0x4ac3ec], eax
test eax, eax
je 0x4117bf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4ac3e8], eax
mov eax, dword [0x4ac3e8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411818
cmp dword [0x4ac3ec], ecx
je 0x411818
push eax
call esi
push dword [0x4ac3ec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411818
test ebx, ebx
je 0x411818
call edi
test eax, eax
je 0x41180f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41180f
test byte [ebp - 8], 1
jne 0x411818
or dword [ebp + 0x10], 0x200000
jmp 0x41184b
mov eax, dword [0x4ac3e0]
cmp eax, dword [ebp - 0x18]
je 0x41184b
push eax
call esi
test eax, eax
je 0x41184b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41184b
mov eax, dword [0x4ac3e4]
cmp eax, dword [ebp - 0x18]
je 0x41184b
push eax
call esi
test eax, eax
je 0x41184b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4ac3dc]
call esi
test eax, eax
je 0x411867
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411869
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408076
leave
ret
Function at 0x48f054
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a9df0]
jne 0x48f05e
repz ret
jmp fcn.00493617

Function at 0x4916d1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a9df0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048bd92
and dword [ebp - 0x14], 0
cmp dword [0x4acaac], 0
mov dword [ebp - 0x18], eax
jne 0x491784
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x49182c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x49182c
mov esi, dword [fcn.00487b10]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4acaac], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4acab0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4acab4], eax
call edi
push eax
call esi
mov dword [0x4acabc], eax
test eax, eax
je 0x491784
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4acab8], eax
mov eax, dword [0x4acab8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00487b14]
cmp eax, ecx
je 0x4917dd
cmp dword [0x4acabc], ecx
je 0x4917dd
push eax
call esi
push dword [0x4acabc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4917dd
test ebx, ebx
je 0x4917dd
call edi
test eax, eax
je 0x4917d4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4917d4
test byte [ebp - 8], 1
jne 0x4917dd
or dword [ebp + 0x10], 0x200000
jmp 0x491810
mov eax, dword [0x4acab0]
cmp eax, dword [ebp - 0x18]
je 0x491810
push eax
call esi
test eax, eax
je 0x491810
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x491810
mov eax, dword [0x4acab4]
cmp eax, dword [ebp - 0x18]
je 0x491810
push eax
call esi
test eax, eax
je 0x491810
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4acaac]
call esi
test eax, eax
je 0x49182c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x49182e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f054
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx