joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a166
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10043840
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100436bf

Function at 0x100488ad
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004856d

Function at 0x42588a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x425899
pop dword [ebp - 0x38]
mov eax, 0x3c802ce5
sub eax, 0x3c3dd44c
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x4d68b
push 0
mov eax, 0x64cf814a
sub eax, 0x648ace9a
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x5eeb8640
sub ecx, 0x5eeb4914
xor esi, esi
add esi, eax
mov edi, 0x488e00
add edi, dword [ebp - 0x38]
mov ebx, 0x78350e81
sub dword [ebp - 0x18], edx
mov edx, dword [edi]
xor dword [ebp - 0x34], esi
xor edx, ebx
add dword [ebp - 0x34], edi
mov dword [esi], edx
sub dword [ebp - 0x18], 0x5bbb2d04
add esi, 0x64ffc33c
sub esi, 0x64ffc338
add edi, 0xa6d1f80c
add edi, 0x592e07f8
loop 0x4258ee
add eax, 0xe783
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xc1d2d781
sub ecx, 0xc192d781
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x409d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x409d2f
pop dword [ebp - 0x40]
mov eax, 0xdad1d728
add eax, 0x256ec607
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x38ef2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x46ec
mov edx, eax
mov esi, 0x7ace4f1a
add esi, 0x8572ecaa
add esi, dword [ebp - 0x40]
mov ebx, 0x7ac3f70
sub ebx, 0x21208312
mov dword [ebp - 0x2c], 0xb16ff6d9
mov edi, dword [esi]
sub dword [ebp - 0x34], 0xbe5e9491
xor edi, ebx
add dword [ebp - 0x18], 0xa1c2cb1e
mov dword [edx], edi
sub dword [ebp - 8], 0x8c662385
add edx, 0x66dc6443
add edx, 0x99239bc1
add esi, 0x2e375e3b
add esi, 0xd1c8a1c9
loop 0x409d83
add eax, 0x9b5f405c
add eax, 0x64a1ce27
xor ebx, ebx
add ebx, eax
add eax, 0x6a7129a1
add eax, 0x958ed664
mov ecx, 0xc4751bc3
sub ecx, 0xc4351bc3
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x40b730
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x42b520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
lea eax, [ebp - 0x18]
push reloc.wininet.dll_DeleteUrlCacheEntry
xor edi, edi
push eax
xor esi, esi
mov dword [ebp - 4], edi
call fcn.0040a1b0
mov ecx, dword [ebp - 0x18]
add esp, 8
cmp dword [ecx - 0xc], edi
je 0x40b805
cmp edi, 2
jge 0x40b805
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x14]
push edx
push 0
xor eax, eax
push 2
test edi, edi
push 0
setne al
push 0
push 0
push ecx
mov dword [ebp - 0x14], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40b7fc
mov esi, dword [ebp - 0x14]
mov ecx, esi
mov dword [ebp - 0x28], ecx
test ebx, ebx
jne 0x40b7c8
lea eax, [ebx + 0xd]
jmp 0x40b7e8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push 0x427880
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x28]
xor edx, edx
test eax, eax
sete dl
mov esi, edx
test ecx, ecx
je 0x40b7fc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
inc edi
jmp 0x40b781
lea eax, [ecx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b845
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4059c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4059d2
pop dword [ebp - 0x1c]
mov eax, 0x56796adf
add eax, 0xa9c6eef3
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xc74987c1
add dword [ebp - 0x2c], 0x8708bd8a
mov dword [ebp - 0x28], 0xad5c3d5
add dword [ebp - 0x28], 0x275d8870
mov dword [ebp - 0x24], 0xfe77feb6
add dword [ebp - 0x24], 0x4dd44578
mov dword [ebp - 0x20], 0xc7199d6d
sub dword [ebp - 0x20], 0xc7199d6d
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xcd3b9ab2
add eax, 0x3308277a
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xbe62e8b0
sub dword [ebp - 0x2c], 0x49f07f5a
mov dword [ebp - 0x28], 0x2dea63b6
sub dword [ebp - 0x28], 0xec7e0241
mov dword [ebp - 0x24], 0xa9229d7a
add dword [ebp - 0x24], 0xba4ccef2
mov dword [ebp - 0x20], 0xf9fe00b5
sub dword [ebp - 0x20], 0xf9fe00b5
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x43d4c
push 0
call eax
mov ecx, 0x5e2f1b6a
sub ecx, 0x5e2edba9
xor edi, edi
add edi, eax
mov esi, 0x671ee928
sub esi, 0x66d79328
add esi, dword [ebp - 0x1c]
mov ebx, 0xbf8e5795
sub ebx, 0xdaa9e051
add dword [ebp - 0x10], ecx
mov edx, dword [esi]
xor dword [ebp - 0xc], edi
sub edx, ebx
xor dword [ebp - 0x10], 0xb91deef3
mov dword [edi], edx
xor dword [ebp - 4], 0xeb1bb560
add edi, 0x4561200e
sub edi, 0x4561200a
add esi, 0xb546d488
sub esi, 0xb546d484
loop 0x405af1
add eax, 0xf906f0c2
add eax, 0x6fa0115
mov ebx, eax
add eax, 0xcc66d654
add eax, 0x339929b1
mov ecx, 0x99572239
sub ecx, 0x99172239
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x405c41
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x43aa02
call fcn.00421920
mov esi, ecx
push 0
lea edi, [esi + 8]
push str.http:__
mov ecx, edi
call main
test eax, eax
je 0x405c7a
push 0
push str.ftp:__
mov ecx, edi
call main
test eax, eax
jne 0x405d0d
push 0x2f
push dword [edi]
call main
pop ecx
pop ecx
test eax, eax
jne 0x405c8e
or eax, 0xffffffff
jmp 0x405c92
sub eax, dword [edi]
sar eax, 1
lea ebx, [eax + 1]
mov eax, dword [edi]
cmp ebx, dword [eax - 0xc]
jne 0x405ca5
mov ecx, edi
call fcn.00401451
jmp 0x405d0d
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 1
push edi
call main
add esi, 0x14
push 0x104
mov ecx, esi
call main
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
push 0xffffffffffffffff
mov ecx, esi
call main
push ebx
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call main
mov eax, dword [eax]
mov ecx, esi
and dword [ebp - 4], 0
push dword [eax - 0xc]
push eax
call main
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00401856
push esi
mov ecx, edi
call main
call fcn.004218ee
ret
Function at 0x405d13
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x18
mov eax, 0x4398e0
call fcn.00421920
mov ebx, ecx
mov dword [ebp - 0x20], ebx
call fcn.0040bac9
push eax
lea ecx, [ebp - 0x10]
call main
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0
push 0x25
mov edi, 0x104
push edi
call main
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call main
push 0x43e5ac
lea ecx, [ebp - 0x10]
call main
push edi
lea ecx, [ebx + 4]
call main
mov edi, dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
push 0
push 0
push ecx
push eax
push edi
call sub.msi.dll_MsiMessageBoxW
push 0xffffffffffffffff
lea ecx, [ebx + 4]
call main
push str.Path
lea ecx, [ebp - 0x18]
call fcn.0040194d
push str.MSI_Updater
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040194d
push 0x453998
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x14]
mov ecx, 0x4538c8
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00408ff6
add ebx, 8
mov byte [ebp - 4], 3
push eax
mov ecx, ebx
call main
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00401856
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00401856
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00401856
mov esi, dword [ebp - 0x20]
mov ecx, esi
call fcn.00405c41
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x405e66
cmp dword [esi + 0xc], 0
jne 0x405e2e
push ebx
mov ecx, 0x4538c8
call fcn.004087cd
test eax, eax
jne 0x405e2e
mov ecx, ebx
call fcn.00401451
jmp 0x405e66
call fcn.0040bac9
push eax
lea ecx, [ebp - 0x18]
call main
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push str.__quiet__norestart__overwriteoem
push eax
call main
mov esi, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, ebx
push dword [esi - 0xc]
push esi
call main
lea ecx, [esi - 0x10]
call fcn.00401856
lea ecx, [edi - 0x10]
call fcn.00401856
call fcn.004218ee
ret

Function at 0x405f86
Capabilities:
Identify system language via api

Disassembly:
push 0xa0
mov eax, 0x439906
call fcn.00421920
mov esi, ecx
mov eax, dword [esi + 8]
cmp dword [eax - 0xc], 0
jne 0x405fa4
xor eax, eax
jmp 0x40601d
cmp dword [esi + 0xc], 0
je 0x40601a
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
mov ecx, 0x3ff
and ax, cx
movzx ecx, ax
xor eax, eax
inc eax
cmp cx, ax
je 0x405fca
cmp ecx, 0xd
je 0x405fca
xor eax, eax
push 0
push eax
lea ecx, [ebp - 0xac]
call main
and dword [ebp - 4], 0
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x14]
call main
lea eax, [esi + 0x14]
push eax
lea ecx, [ebp - 0x10]
call main
lea ecx, [ebp - 0xac]
call fcn.0040c3b7
lea ecx, [ebp - 0xac]
lea esi, [eax - 1]
neg esi
sbb esi, esi
or dword [ebp - 4], 0xffffffff
call fcn.004019dc
lea eax, [esi + 1]
jmp 0x40601d
xor eax, eax
inc eax
call fcn.004218ee
ret
Function at 0x4066a3
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 4
push ebx
push ebx
push 0x43cbc8
call main
mov dword [esi + 0x20], eax
mov dword [eax + 0x44], 0x3f1
mov eax, dword [esi + 0x20]
push dword [eax + 0x2c]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov edi, ebx
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4066dd
cmp dword [eax + 0x20], ebx
jne 0x4066ed
cmp edi, 2
jge 0x4066ed
push 0x64
inc edi
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066d1
mov ecx, eax
pop edi
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x24], eax
mov eax, dword [ecx + 0x2c]
mov dword [esi + 0x28], eax
pop esi
pop ebx
ret
Function at 0x438cb3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x438a14
or ebx, ecx
dec ebx
call fcn.00438cef
mov ebx, ebx
inc ebx
xor dword [edi], eax
add ecx, ecx
or ecx, ecx
add edi, 1
add ecx, 0x1801e25
cmp edi, esi
jne fcn.00438cb3
mov ecx, 0xfb63a090
dec ecx
ret
Function at 0x4098b6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x417004]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0xc]
lea ecx, [ebp - 0x6c]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push ecx
push 0x20019
push ebx
movzx eax, al
push 0x406e10
sub eax, 0x7fffffff
mov dword [ebp - 0x6c], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x409918
push 0x406dcc
mov ecx, esi
call fcn.00409db3
cmp dword [ebp - 0x6c], ebx
je 0x4099c0
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4099c0
push edi
push 0x64
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], ebx
push ebx
push eax
call fcn.0040cf80
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push ebx
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x406db8
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4099a5
mov edi, dword [ebp - 0x74]
test edi, edi
je 0x4099a5
cmp dword [ebp - 0x70], 1
jne 0x4099a5
shr edi, 1
cmp edi, 0x32
jae 0x4099a5
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x406db8
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [edi + edi]
mov edx, eax
cmp word [ebp + ecx - 0x6a], bx
je 0x409996
lea eax, [edi + 1]
cmp eax, 0x32
jae 0x409996
cmp ecx, 0x64
jae 0x4099d2
xor eax, eax
mov word [ebp + ecx - 0x68], ax
lea eax, [ebp - 0x68]
test edx, edx
je 0x4099a2
mov eax, 0x406dcc
push eax
jmp 0x4099aa
push 0x406dcc
mov ecx, esi
call fcn.00409db3
cmp dword [ebp - 0x6c], ebx
je 0x4099bf
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b2a3
leave
ret 8
call fcn.0040b3d3
int3

Function at 0x40d305
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40d340
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40d327
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40d338
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40d342
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40d31d
xor eax, eax
pop edi
pop esi
ret
Function at 0x40d4bf
Capabilities:
Enumerate pe sections

Disassembly:
std
invalid
add byte [eax], al
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.0040d2c5
in al, 0xf8
and eax, 0x47b70f5a
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.0040d2c5
jle 0x40d4af
jge 0x40d4e9
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x40d51f
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x40d519
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x40d50a
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0040d2c5
int 0xc9
inc ebp
sub dword [ebp - 0x17af57bb], ecx
pop edi
std
invalid

Function at 0x40d5c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040d2c5
invalid
Function at 0x40db55
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0040d2d5
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040d28a
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040d2d5
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040d28a
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0040d2d5
mov ebp, 0x59fffff5
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040d28a
inc dword [ebx - 0x7a76f33c]
sar ah, 0xff
invalid
call fcn.0040d2c5
jge 0x40dd35
mov eax, 0xcca5803e
cli
invalid
Function at 0x40e154
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x544], 0
push 0
call dword [ebp - 0x340]
sar ah, 0xff
dec dword [ecx + 0x4680845]
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax + 0x6a]
add bh, bh
xchg ebp, eax
enter 0xfffffffffffffffa, 0xffffffffffffffff
call fcn.0040d2c5
popfd
stc
jecxz 0x40e202
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040d2a3
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
stosb byte es:[edi], al
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040d2d5
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040d28a
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040d2c5

Function at 0x40f35b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
cmp dword [ebp - 0x37c], 0
je 0x40f366
jmp 0x40f36b
jmp 0x40ec67
Function at 0x40f4a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ch, 0x7c
stc
invalid
cmp byte [eax + 0x1c], 0x18
je 0x40f489
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0040d2c5
pop eax
xor byte [edi], ch
jg 0x40f422
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
fucompi st(0)
pop ss
fdivp st(7)
dec ebx
fucompi st(0)
pop ss
fdivp st(7)
dec ebx
mov byte [eax + 0x348b49c5], bl
mov eax, dword [ebx]
idiv dword [eax + 0x50746547]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x40f4b2
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x40f4b2
call fcn.0040d2c5
dec ebx
pop esp
xor eax, 0x245a8b7f
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0040d2c5
jnp 0x40f481
or edx, dword [ebx - 0xf78a01]
jne 0x40f4fb
push dword [ebp]
call fcn.0040dac5
jl 0x40f503
invalid
mov esi, eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00411d72
pop esi
pop ebp
ret

Function at 0x416590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4165bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4165bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x50f12b70
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x18611aa3
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x404550
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp byte [edi + 4], 0
je 0x40458f
mov eax, dword [edi + 8]
test eax, eax
je 0x40458f
push esi
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.0052ea9a
push dword [edi + 8]
mov esi, eax
call fcn.0052eb75
add esp, 0x14
or ecx, 0xffffffff
test eax, eax
cmovne esi, ecx
mov eax, esi
pop esi
pop edi
pop ebp
ret 8
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x4045a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp byte [edi + 4], 0
je 0x4045df
mov eax, dword [edi + 8]
test eax, eax
je 0x4045df
push esi
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.0052edd8
push dword [edi + 8]
mov esi, eax
call fcn.0052eb75
add esp, 0x14
or ecx, 0xffffffff
test eax, eax
cmovne esi, ecx
mov eax, esi
pop esi
pop edi
pop ebp
ret 8
xor eax, eax
pop edi
pop ebp
ret 8