joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
fld qword [0x44f560]
push ebx
fadd qword [0x44f328]
mov ax, word [0x44f130]
movsx ecx, ax
sub ecx, 0x31edafe
push esi
push edi
or edi, 0xffffffff
add word [0x44f130], di
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
fld qword [0x44f560]
fld1
fsub st(1), st(0)
fxch st(1)
fstp qword [0x44f560]
fxch st(2)
fucompi st(1)
fstp st(0)
lahf
test ah, 0x44
jp 0x402b0e
fld dword [0x44f44c]
fadd st(1)
fstp dword [0x44f44c]
fadd qword [0x44f5b8]
fstp qword [0x44f5b8]
fld dword [0x44f548]
fld dword [0x44f44c]
fadd qword [0x4491c8]
fadd qword [0x44f5b8]
fsubp st(1)
fstp dword [0x44f548]
jmp 0x402b10
fstp st(0)
mov edx, dword [ebp + 0xc]
add edx, 4
push edx
call fcn.0041c2d9
add word [0x44f020], di
inc word [0x44f720]
mov esi, eax
mov ax, word [0x44f720]
mov cx, word [0x44f020]
cwde
movsx edx, cx
add eax, 0x47aad4a
add esp, 4
cmp edx, eax
mov dword [ebp - 4], esi
jge 0x402b61
movzx eax, word [0x44f720]
mov ecx, 0x6bd0e2be
sub ecx, eax
mov word [0x44f20c], cx
mov edi, dword [ebp + 8]
jmp 0x402b70
mov al, byte [edi + str.X_zsu]
mov byte [esi], al
mov edx, dword [0x451130]
movzx ecx, byte [edx + edi]
xor cl, al
mov byte [esi], cl
inc edi
fld dword [0x44f5f0]
inc esi
fmul qword [0x4491c0]
dec esi
inc edi
fstp dword [0x44f5f0]
fld dword [0x44f368]
fadd qword [0x448d90]
fstp dword [0x44f368]
fld dword [0x44f368]
mov dx, word [0x44f5f4]
fadd qword [0x4491b8]
movsx eax, dx
cvtsi2sd xmm0, eax
mov al, byte [edi + 0x445287]
fsubr qword [0x4491b0]
fstp qword [ebp - 0xc]
mulsd xmm0, qword [ebp - 0xc]
cvttsd2si ecx, xmm0
mov word [0x44f5f4], cx
mov byte [esi + 1], al
mov edx, dword [0x451130]
movzx ecx, byte [edx + edi - 1]
xor cl, al
mov byte [esi + 1], cl
movzx eax, word [esi]
movzx ebx, ax
lea edx, [ebx + 3]
push edx
lea eax, [edi + str.X_zsu]
push eax
push esi
call fcn.0041c3b0
movzx ecx, word [0x44f714]
mov edx, dword [0x451130]
add ecx, 0xf90b652
lea eax, [ebx + esi + 3]
add esp, 0xc
add edi, edx
mov word [0x44f714], cx
mov ecx, esi
cmp esi, eax
je 0x402c4a
lea ebx, [ebx]
mov dl, byte [edi]
xor byte [ecx], dl
inc ecx
inc edi
cmp ecx, eax
jne 0x402c40
cmp dword [ebp + 0xc], ebx
je 0x402ca6
mov byte [eax], 0
mov ecx, dword [0x44f110]
mov dword [ebp + 8], ecx
fild dword [ebp + 8]
sub eax, 3
mov esi, eax
fmul qword [0x44f338]
fstp qword [0x44f338]
mov dx, word [0x44f038]
mov edi, dword [eax]
mov ax, word [0x44f2dc]
movsx ecx, dx
cwde
sub eax, ecx
mov ecx, dword [0x44f304]
add ecx, eax
sub dword [ebp + 0xc], ebx
mov dword [ebp + 8], ecx
fild dword [ebp + 8]
fmul qword [0x44f3b0]
fstp qword [0x44f3b0]
jmp 0x402b70
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
fld qword [0x44f400]
fld1
fadd st(1), st(0)
fxch st(1)
fstp qword [0x44f400]
fadd qword [0x44f2d0]
fstp qword [0x44f2d0]
fld qword [0x44f400]
fld qword [0x44f2d0]
fsubr qword [0x449660]
fcompi st(1)
fstp st(0)
jb 0x4065dc
movzx eax, word [0x44f12c]
sub eax, 0x7020fcbf
mov word [0x44f12c], ax
cmp dword [0x4515e4], 0
jne 0x406601
call fcn.00403680
mov ecx, dword [0x44f298]
imul ecx, ecx, 0xee71cfb9
mov dword [0x4515e4], eax
mov dword [0x44f298], ecx
push ebx
push esi
push edi
push 3
push 0x2a1
call fcn.00402a80
mov ebx, dword [ebp + 8]
mov edi, eax
mov edx, 1
add word [0x44f688], dx
movzx eax, word [0x44f688]
movsx ecx, ax
movzx eax, word [0x44f198]
cwde
sub eax, ecx
mov ecx, dword [0x44f4dc]
add ecx, eax
push edi
mov word [0x44f198], cx
add dword [0x44f4dc], edx
push ebx
call fcn.0041d1e8
push edi
push 3
mov esi, eax
call fcn.0041a660
add esp, 0x18
test esi, esi
jne 0x4066da
push 0x3e8
call dword [0x450d80]
fld dword [0x44f428]
mov edx, dword [0x44f698]
add edx, 0x5772b5d7
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fld dword [0x44f428]
fsub qword [0x448d90]
fstp dword [0x44f428]
fxch st(1)
fcompi st(1)
fstp st(0)
jb 0x4066b8
dec dword [0x44f43c]
mov ecx, dword [0x44f43c]
mov eax, 0x1432b8d5
sub eax, ecx
add dword [0x44f294], eax
push 3
push 0x2a1
call fcn.00402a80
mov edi, eax
push edi
push ebx
call fcn.0041d1e8
push edi
push 3
mov esi, eax
call fcn.0041a660
add esp, 0x18
fld dword [0x44f174]
fsubr qword [0x449658]
fsub qword [0x449650]
fstp dword [0x44f64c]
test esi, esi
je 0x40670e
push esi
push 1
push 4
push 0x4515e4
call fcn.0041d664
push esi
call fcn.0041d486
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40dff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
fld qword [0x44f318]
sub esp, 8
fadd qword [0x44f030]
fsub qword [0x44f0b8]
fld qword [0x448ee0]
fld qword [0x44f0b8]
fld1
fadd st(1), st(0)
fxch st(1)
fstp qword [0x44f0b8]
fld qword [0x44f318]
fadd st(1)
fstp qword [0x44f318]
fld qword [0x44f030]
fsub st(1)
fstp qword [0x44f030]
fxch st(2)
fucompi st(1)
fstp st(0)
lahf
test ah, 0x44
jp 0x40e0a3
fld dword [0x44f300]
fsub qword [0x448ed8]
fld qword [0x448ed0]
fld dword [0x44f300]
fsub st(3)
fstp dword [0x44f300]
fcompi st(1)
fstp st(0)
jbe 0x40e0ad
fld qword [0x44f650]
mov eax, dword [0x44f304]
fadd qword [0x448ec8]
cvtsi2sd xmm0, eax
fstp qword [ebp - 8]
addsd xmm0, qword [ebp - 8]
cvttsd2si ecx, xmm0
mov dword [0x44f304], ecx
fadd qword [0x44f650]
fstp qword [0x44f650]
jmp 0x40e0af
add dword [0x44f228], 0xd1945be5
fstp st(0)
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push esi
lea esi, [ecx + edx*4]
cmp ecx, esi
je 0x40e107
xor dword [ecx], eax
movzx edx, word [0x44f6f8]
sub edx, 0x237e85c
mov word [0x44f6f8], dx
mov edx, dword [0x44f180]
imul edx, edx, 0xe7d4d324
ror eax, 1
mov dword [ebp + 8], eax
mov dword [0x44f180], edx
mov dl, byte [ebp + 8]
shr eax, 8
add al, dl
add dl, al
add ecx, 4
mov byte [ebp + 9], al
mov byte [ebp + 8], dl
mov eax, dword [ebp + 8]
cmp ecx, esi
jne 0x40e0c0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415690
Capabilities:
Hash data with md5

Disassembly:
mov ax, word [0x44f20c]
mov edx, dword [0x44f668]
cwde
sub edx, eax
mov word [0x44f480], dx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
ret

Function at 0x41e736
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44fd18]
jne 0x41e740
repz ret
jmp fcn.0042c38c

Function at 0x435640
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042256f
and dword [ebp - 4], 0
cmp dword [0x4520bc], 0
mov ebx, eax
jne 0x4356f1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4357a2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4357a2
push eax
call fcn.004224fd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4520bc], eax
call esi
push eax
call fcn.004224fd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4520c0], eax
call esi
push eax
call fcn.004224fd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4520c4], eax
call esi
push eax
call fcn.004224fd
pop ecx
mov dword [0x4520cc], eax
test eax, eax
je 0x4356f1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004224fd
pop ecx
mov dword [0x4520c8], eax
mov eax, dword [0x4520c8]
cmp eax, ebx
je 0x435749
cmp dword [0x4520cc], ebx
je 0x435749
push eax
call fcn.00422578
push dword [0x4520cc]
mov esi, eax
call fcn.00422578
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x435749
test edi, edi
je 0x435749
call esi
test eax, eax
je 0x435740
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x435740
test byte [ebp - 0xc], 1
jne 0x435749
or dword [ebp + 0x10], 0x200000
jmp 0x435782
mov eax, dword [0x4520c0]
cmp eax, ebx
je 0x435782
push eax
call fcn.00422578
pop ecx
test eax, eax
je 0x435782
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x435782
mov eax, dword [0x4520c4]
cmp eax, ebx
je 0x435782
push eax
call fcn.00422578
pop ecx
test eax, eax
je 0x435782
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4520bc]
call fcn.00422578
pop ecx
test eax, eax
je 0x4357a2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4357a4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4069a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x20019
push edi
movzx eax, cl
mov esi, edx
push 0x405d28
sub eax, 0x7fffffff
mov dword [ebp - 4], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4069e5
jle 0x406a42
movzx eax, ax
or eax, 0x80070000
jmp 0x406a42
or dword [ebp - 0x10], 0xffffffff
mov ecx, esi
push 0x32
pop eax
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], esi
call fcn.00406db8
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], eax
push ecx
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x405d10
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00406cd0
test esi, esi
je 0x406a35
jle 0x406a31
movzx esi, si
or esi, 0x80070000
mov eax, esi
jmp 0x406a42
mov eax, dword [ebp - 8]
dec eax
neg eax
sbb eax, eax
and eax, 0x8000ffff
pop edi
pop esi
leave
ret

Function at 0x40705e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
lea ebx, [edx + edx]
lea esi, [eax + eax]
test esi, esi
je 0x40709f
test ecx, ecx
jne 0x407087
call fcn.0040baa8
mov dword [eax], 0x16
pop esi
pop ebx
pop ebp
jmp fcn.0040b9ea
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4070a3
cmp ebx, esi
jb 0x4070a3
push esi
push edi
push ecx
call fcn.00408100
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret
push ebx
push 0
push ecx
call fcn.00409590
add esp, 0xc
test edi, edi
jne 0x4070c1
call fcn.0040baa8
mov dword [eax], 0x16
pop edi
jmp 0x40707f
cmp ebx, esi
jae 0x40709e
call fcn.0040baa8
mov dword [eax], 0x22
jmp 0x4070be

Function at 0x40b4bf
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40b4fa
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40b4e1
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40b4f2
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40b4fc
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40b4d7
xor eax, eax
pop edi
pop esi
ret
Function at 0x40b6de
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test eax, 0x58aa45c6
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0040b47f
pop ebp
lea ecx, [ecx - 0x57ba7218]
call 0x50e8fcb8
call fcn.0040b48f
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0040b444
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40b76d
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040b47f
popfd
out 0xfe, al
mov cl, byte [ebp - 0x17af3fbb]
invalid

Function at 0x40b96d
Capabilities:
Inspect section memory permissions

Disassembly:
push eax
call fcn.0040b48f
push eax
push esi
push dword [ebp + 8]
call fcn.0040b444
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x40bc78
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.0040b3f0
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x40b9ef

Function at 0x40b9ea
Capabilities:
Inspect section memory permissions

Disassembly:
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.0040b3f0
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
cmp eax, dword [edi + 6]
cmp eax, dword [edi + 6]
jb 0x40b9bc
call fcn.0040b47f
popfd
test byte [ebp - 0x75], bh
invalid
invalid
Function at 0x40ba71
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x40ba24
cmp dword [eax + 0xc], ebx
je 0x40bac7
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.0040b47f
sub dword [edx], edx
add al, 0x9e
cmp dword [ebp + 0xc], ebx
jne 0x40ba53
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x40bc6e
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x40ba67
mov dword [ebp + 0x10], edi
jmp 0x40ba6c
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.0040b47f
out dx, eax
jno 0x40baa3
std
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x40bab5
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x40ba90
and eax, 0xffff
push eax
jmp 0x40ba94
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040b444
add esp, 0xc
cmp edi, ebx
sti
mov dword [edi], eax
je 0x40bc6e
ret 1
invalid
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x40ba75
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
js 0x40babc
invalid
dec dword [ebx + 0x4fe9bc45]
invalid
invalid
invalid
call fcn.0040b47f
inc ebx
jle 0x40bb32
mov eax, dword [edi + 0xa0]
test eax, 0xeb0c5d89
push es
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
inc edi
push es
jne 0x40bb56
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40bb74
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40bbd2
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40bbb9
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40bbc2
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40bbcc
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40bbae
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40bb38
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40bc1f
dec eax
je 0x40bc16
sub eax, 3
je 0x40bc0d
mov dword [ebp - 4], 0x40
jmp 0x40bc3c
mov dword [ebp - 4], 4
jmp 0x40bc22
mov dword [ebp - 4], 0x20
jmp 0x40bc22
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40bc6e
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40bbee
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040b47f
cli
adc ecx, edx
push esi
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x40bc7a
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40bad6
Capabilities:
Inspect section memory permissions

Disassembly:
cmp eax, ebx
je 0x40bb33
add eax, esi
cmp dword [eax], ebx
je 0x40bb33
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x40bb2e
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40bb18
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x40bb20
cmp edx, ebx
jne 0x40bc6e
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x40baef
add eax, dword [eax + 4]
jmp 0x40badc
mov dword [ebp + 0xc], ebx
jmp 0x40bb3e

Function at 0x40bcd6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [edx - 0x3a]
test dword [esi + 0x46fffffc], esi
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0040b48f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040b444
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040b48f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040b444
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0040b48f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040b444
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.0040b47f
invalid
Function at 0x40d4db
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x40d515
lea eax, [ebp - 0x714]
push eax
call fcn.0040b48f
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.0040b444
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x40d520
jmp 0x40d525
jmp 0x40ce21

Function at 0x40d963
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x41500c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x40d9ae
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0040db85
test al, al
jne 0x40d9a8
sub edx, 2
cmp edx, edi
jne 0x40d98e
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x40d9d0
lea eax, [edi + 2]
cmp edx, eax
je 0x40d9d0
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0040d8af
add esp, 0x10
jmp 0x40daca
push esi
lea ecx, [ebp - 0x255]
call fcn.0040db85
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40da13
push dword [ebp - 0x25c]
jmp 0x40d9c0
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x40da50
cmp word [ebp - 0x226], 0
je 0x40da71
cmp word [ebp - 0x226], ax
jne 0x40da50
cmp word [ebp - 0x224], 0
je 0x40da71
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0040d8af
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x40dabd
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x40da2a
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x40daa5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x40daca
push 0x40d6df
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00410640
add esp, 0x10
jmp 0x40da9a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004073a8
leave
ret