joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b98fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, ecx
and dword [esi + 0x30], 0
push edi
call fcn.004b97c1
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov ebx, dword [edi]
jmp 0x4b9940
push 0xa
push 0xa
push 0x10af204
push 0x3114b604
call fcn.004b9fe6
add esp, 0xc
push eax
push dword [ebx + 0x30]
call fcn.004b9830
add esp, 0xc
test eax, eax
je 0x4b9949
mov ebx, dword [ebx]
cmp ebx, edi
jne 0x4b9918
jmp 0x4b99db
mov ebx, dword [ebx + 0x18]
test ebx, ebx
je 0x4b99db
mov eax, dword [ebx + 0x3c]
mov edi, dword [eax + ebx + 0x78]
and dword [esp + 0xc], 0
add edi, ebx
mov eax, dword [edi + 0x1c]
add eax, ebx
push ebp
mov ebp, dword [edi + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x24]
add eax, ebx
add ebp, ebx
cmp dword [edi + 0x18], 0
mov dword [esp + 0x18], eax
jbe 0x4b99d7
mov eax, dword [esp + 0x10]
mov eax, dword [ebp + eax*4]
push 0x16
add eax, ebx
push 0x10af1ec
push 0x40704011
mov dword [esp + 0x20], eax
call fcn.004b9f98
push eax
push dword [esp + 0x24]
call fcn.004b985c
add esp, 0x14
test eax, eax
je 0x4b99bf
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [edi + 0x18]
jb 0x4b9980
jmp 0x4b99d7
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
movzx eax, word [eax + ecx*2]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + eax*4]
add eax, ebx
mov dword [esi + 4], eax
mov dword [esi + 0x30], ebx
pop ebp
cmp dword [esi + 0x30], 0
je 0x4b9b42
push 0xa
push 0x10af1e0
push 0x29a1a909
call fcn.004b9f98
add esp, 0xc
push eax
push esi
mov ecx, esi
call fcn.004b98d2
push 0xc
push 0x10af1d0
push 0x13cbcee9
call fcn.004b9f98
add esp, 0xc
push eax
lea eax, [esi + 8]
push eax
mov ecx, esi
call fcn.004b98d2
push 0x18
push 0x10af1b4
push 0x17ce53be
call fcn.004b9f98
add esp, 0xc
push eax
lea eax, [esi + 0xc]
push eax
mov ecx, esi
call fcn.004b98d2
push 0xf
push 0x10af1a4
push 0x26b30b69
call fcn.004b9f98
add esp, 0xc
push eax
lea eax, [esi + 0x10]
push eax
mov ecx, esi
call fcn.004b98d2
push 0x12
push 0x10af190
push 0x3d924530
call fcn.004b9f98
add esp, 0xc
push eax
lea eax, [esi + 0x14]
push eax
mov ecx, esi
call fcn.004b98d2
push 7
push 0x10af188
push 0x2236409a
call fcn.004b9f98
add esp, 0xc
push eax
lea eax, [esi + 0x18]
push eax
mov ecx, esi
call fcn.004b98d2
push 0x14
push 0x10af170
push 0x149ccd04
call fcn.004b9f98
add esp, 0xc
push eax
lea eax, [esi + 0x1c]
push eax
mov ecx, esi
call fcn.004b98d2
push 0x11
push 0x10af15c
push 0x673ebfe9
call fcn.004b9f98
add esp, 0xc
push eax
lea eax, [esi + 0x20]
push eax
mov ecx, esi
call fcn.004b98d2
push 0x11
push 0x10af148
push 0x68d29b96
call fcn.004b9f98
add esp, 0xc
push eax
lea eax, [esi + 0x24]
push eax
mov ecx, esi
call fcn.004b98d2
push 0x16
push 0x10af130
push 0x7db65c79
call fcn.004b9f98
add esp, 0xc
push eax
lea eax, [esi + 0x28]
push eax
mov ecx, esi
call fcn.004b98d2
push 0x13
push 0x10af11c
push 0x65fa79df
call fcn.004b9f98
add esp, 0xc
push eax
lea eax, [esi + 0x2c]
push eax
mov ecx, esi
call fcn.004b98d2
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4b9b4b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, 0x10b0000
mov ecx, 0x7acb
mov esi, 0x3ce0e3
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov edx, ecx
shr edx, 0xc
xor byte [eax], dl
inc eax
dec esi
jne 0x4b9b5b
pop esi
ret

Function at 0x4b9cb7
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push ebx
mov ebx, eax
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
movzx eax, word [esi + 0x14]
push edi
lea edi, [eax + esi + 0x18]
xor eax, eax
cmp ax, word [esi + 6]
jae 0x4b9cfe
push 7
push 0x10af220
push edi
call fcn.004b9830
add esp, 0xc
test eax, eax
je 0x4b9d05
movzx eax, word [esi + 6]
inc dword [ebp - 4]
add edi, 0x28
cmp dword [ebp - 4], eax
jl 0x4b9cdb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0xc]
mov esi, dword [eax + ebx]
lea edi, [eax + ebx + 8]
mov ebx, dword [eax + ebx + 4]
push esi
call fcn.004ba044
and dword [ebp - 8], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
push 1
push 5
push edi
lea ecx, [ebp - 0xc]
push ecx
add edi, 5
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], 0x401960
mov dword [ebp - 0x14], 0x40196b
call fcn.004bb9b0
add esp, 0x28
test eax, eax
je 0x4b9d65
push dword [ebp - 4]
call fcn.004ba05b
pop ecx
jmp 0x4b9cfe
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp - 4]
jmp 0x4b9d00

Function at 0x4b9f98
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
je 0x4b9fd7
push edi
mov edi, dword [esp + 0x14]
sub edi, 0x147e0f0
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov eax, edx
shr eax, 0xc
xor al, byte [edi + esi + 0x147e0f0]
inc esi
mov byte [esi + 0x147e0ef], al
cmp esi, ebx
jb 0x4b9fb3
pop edi
pop esi
mov byte [ebx + 0x147e0f0], 0
mov eax, 0x147e0f0
pop ebx
ret

Function at 0x4b9fe6
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
je 0x4ba024
mov eax, dword [esp + 0x10]
sub eax, 0x147e0f0
push ebx
imul edx, edx, 0x19660d
add edx, 0x3c6ef35f
mov ebx, edx
shr ebx, 0xc
xor bl, byte [eax + esi + 0x147e0f0]
inc esi
mov byte [esi + 0x147e0ef], bl
cmp esi, edi
jb 0x4ba000
pop ebx
mov byte [edi + 0x147e0f0], 0
mov byte [edi + 0x147e0f1], 0
pop edi
mov eax, 0x147e0f0
pop esi
ret
Function at 0x4ba100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x4ba119
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x4ba13c
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x4ba141
inc edi
cmp edi, dword [ebp - 4]
jb 0x4ba133
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x4ba239
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x4ba198
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x4ba16c
cmp cl, 0xff
jne 0x4ba1c3
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x4ba1d1
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x4ba1d8
dec ecx
shl edx, cl
and edx, 7
je 0x4ba15d
movzx ecx, byte [edx + 0x10af294]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x10af28c], 0
mov cl, byte [ebx + 4]
je 0x4ba1c0
test cl, cl
je 0x4ba1c0
cmp cl, 0xff
jne 0x4ba15d
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x4ba12e
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x4ba20c
movzx esi, byte [edx + 0x10af294]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x4ba1f7
cmp al, 0xff
jne 0x4ba209
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x4ba18a
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x4ba12e
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x401cd7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0x14], edx
call fcn.0040b934
mov ebx, eax
call fcn.0040b934
imul ebx, eax
mov dword [ebp - 8], ebx
call fcn.0040b934
and eax, 7
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ebx, ebx
cmp ebx, dword [ebp + 0x14]
jge 0x401fcc
mov edx, dword [ebp + 0x10]
movzx edi, byte [edx + ebx]
mov edx, edi
mov ecx, eax
and cl, 0xff
xor dl, cl
mov ecx, dword [ebp + 0x10]
mov byte [ecx + ebx], dl
mov ecx, dword [ebp - 4]
mov edx, eax
shl edx, cl
and edx, 0xffffffff
mov dword [ebp - 0xc], edx
mov ecx, 0x20
sub ecx, dword [ebp - 4]
shr eax, cl
and eax, 0xffffffff
or eax, dword [ebp - 0xc]
add eax, edi
sar edi, 1
jns 0x401d55
adc edi, 0
lea edx, [edi + edi*2]
add eax, edx
inc ebx
cmp ebx, dword [ebp + 0x14]
jl 0x401d19
jmp 0x401fcc
mov eax, dword [ebp - 0x14]
cmp eax, 0x15
ja 0x401fad
jmp dword [eax*4 + 0x401378]
inc dword [ebp - 0x14]
call fcn.0040b934
mov ebx, eax
and ebx, 3
test ebx, ebx
je 0x401fcc
push esi
call fcn.00401bcd
pop ecx
mov esi, eax
dec ebx
test ebx, ebx
jne 0x401fbe
cmp dword [ebp - 0x10], 0
je 0x401d65
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1e7a7500
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 4], 0x1e7ba2c0
je 0x1e7a751c
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
ret 8
mov eax, dword [eax + 8]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [esp + 8]
cmp ecx, 2
jne 0x1e7a7541
test eax, eax
je 0x1e7a754a
mov eax, dword [sym.imp.python27.dll__Py_TrueStruct]
inc dword [eax]
ret 8
cmp ecx, 3
jne 0x1e7a7554
test eax, eax
je 0x1e7a7537
mov eax, dword [sym.imp.python27.dll__Py_ZeroStruct]
inc dword [eax]
ret 8
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
ret 8

Function at 0x1e7a9b30
Capabilities:
Enumerate pe sections

Disassembly:
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1e7a9b65
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1e7a9b4c
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1e7a9b5d
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1e7a9b67
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1e7a9b42
xor eax, eax
pop edi
pop esi
ret

Function at 0x1e7a9dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
je 0x1e7a9dd8
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
inc ebp
int3
jg 0x1e7a9dda
inc ebp
int 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1e7a9aea
int1
stosd dword es:[edi], eax
wait
invalid
lea eax, [ebp - 0x40]
push eax

Function at 0x1e7a9e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.1e7a9afa
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a9aaf
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.1e7a9aea
add edx, ebx
inc ebx
clc
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
out dx, eax
retf
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1e7a9afa
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a9aaf
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
xchg esi, eax
mov esi, 0xc6975d88
inc ebp
cwde
pop ss
Function at 0x1e7a9eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg esi, eax
mov esi, 0xc6975d88
inc ebp
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1e7a9afa
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a9aaf
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a9afa
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a9aaf
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a9aea
fisttp word [ecx + ebp + 0x56]
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
invalid
inc ebp
invalid

Function at 0x1e7aa1d0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7aa1c1
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7aa1df
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
or byte [ecx], al
add byte [eax], al
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7aa23d
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7aa224
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7aa22d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7aa237
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7aa219
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
invalid
invalid
Function at 0x1e7aa320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.1e7a9afa
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a9aaf
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax

Function at 0x1e7aa3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
test dword [eax - 4], ecx
invalid
inc dword [ebx]
mov byte [ebp - 0x3b7], 0x20
invalid
invalid
dec edx
Function at 0x1e7aa660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.1e7a9afa
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a9aaf
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
test eax, ebp
cli
invalid
invalid
ljmp 0xffff
push eax
call fcn.1e7a9afa
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a9aaf
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.1e7a9aea
mov ch, 0xdd
test al, al
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
cli
invalid
call [ebx - 0x3a]
test ecx, esi
cli
invalid
invalid
jns 0x1e7aa6f2
test edx, esi
cli
invalid
jmp [eax - 0x3a]
test ebx, esi
cli
invalid
call [edx - 0x3a]
test esp, esi
cli
invalid
push dword [ebp - 0x3a]
test ebp, esi
cli
invalid
push dword [eax - 0x3a]
test esi, esi
cli
invalid
invalid
jns 0x1e7aa715
test edi, esi
cli
invalid
dec dword [edi - 0x3a]
test eax, edi
cli
invalid
push dword [ebp - 0x3a]
test ecx, edi
cli
invalid
jmp dword [esi - 0x3a]
test edx, edi
cli
invalid
invalid
jns 0x1e7aa731
test ebx, edi
cli
invalid
call [ecx*4 - 0x5137b]
call dword [eax - 0x18]
jge 0x1e7aa76e
invalid
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a9aaf
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.1e7a9aea
xchg ebp, eax
jmp 0x22e2bd0f
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x56b7779e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x6ba329be
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6858140d
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0xb113168
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219