joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002dfc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x430
mov eax, 0x1002f31c
call fcn.10023a3f
mov eax, dword [ebp + 0xc]
mov edi, ecx
mov ebx, edx
mov dword [ebp - 0x428], eax
call dword [0x10039cf0]
xor esi, esi
mov dword [ebp - 0x43c], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x424], esi
push 2
push esi
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp eax, esi
mov dword [ebp - 0x42c], eax
jne 0x10002e62
call fcn.10005430
mov esi, eax
jmp 0x10002f87
push dword [ebp - 0x428]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x10002e80
call fcn.10005430
jmp 0x10002f79
push edi
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
mov dword [ebp - 0x430], eax
je 0x10002e76
push edi
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
mov dword [ebp - 0x428], edi
jae 0x10002ed6
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x10002ecc
lea eax, [ebp - 0x424]
call fcn.1000fb59
mov eax, 0x8007000e
jmp 0x10002fa2
push 2
pop ecx
mul ecx
cmp edx, esi
mov byte [ebp - 4], 2
ja 0x10002ee8
cmp eax, 0xffffffff
jbe 0x10002ef2
push 0x80070057
call fcn.10017340
cmp eax, 0x400
jbe 0x10002f18
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.10009e15
jmp 0x10002f24
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
mov dword [ebp - 4], 1
mov ebx, dword [ebp - 0x424]
cmp ebx, esi
jne 0x10002f3c
mov esi, 0x8007000e
jmp 0x10002f7b
call dword [0x10039cf0]
push edi
push ebx
push edi
push dword [ebp - 0x430]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x10002e76
mov ecx, dword [ebp - 0x424]
push dword [ebp + 0x10]
mov word [ecx + eax*2], si
mov ecx, dword [ebp - 0x424]
lea edx, [ebp - 0x438]
call fcn.100055c4
mov esi, eax
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x10002fa0
lea eax, [ebp - 0x424]
call fcn.1000fb59
mov eax, esi
call fcn.1000ae02
ret 0xc
Function at 0x1000cfe0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10039030]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
lea edx, [ebp - 0x214]
push edx
push 0x2001f
mov eax, ecx
mov ecx, dword [ebp + 8]
xor esi, esi
push esi
mov dword [ebp - 0x220], eax
mov eax, dword [eax]
push ecx
push eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
cmp edi, esi
jne 0x1000d0fd
xor eax, eax
cmp dword [ebp - 0x210], esi
je 0x1000d04e
push dword [ebp - 0x210]
call ebx
cmp eax, esi
mov ecx, dword [ebp - 0x214]
mov edi, eax
mov dword [ebp - 0x210], ecx
jne 0x1000d0fd
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push ecx
jmp 0x1000d0c1
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.1000cfe0
cmp eax, esi
mov dword [ebp - 0x214], eax
jne 0x1000d120
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0x100
call edi
test eax, eax
je 0x1000d086
cmp dword [ebp - 0x210], esi
je 0x1000d0e7
push dword [ebp - 0x210]
call ebx
mov dword [ebp - 0x210], esi
push dword [ebp - 0x21c]
mov eax, dword [ebp - 0x220]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp dword [ebp - 0x210], esi
je 0x1000d10d
push dword [ebp - 0x210]
call ebx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10013013
leave
ret 4
cmp dword [ebp - 0x210], esi
je 0x1000d130
push dword [ebp - 0x210]
call ebx
mov eax, dword [ebp - 0x214]
jmp 0x1000d10f
Function at 0x1001272a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x1001273d
push 0x80004005
call fcn.10017340
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x10012744
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10013013
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10039030]
jne 0x1001301d
repz ret
jmp fcn.1000ae11
Function at 0x10022650
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1001ec13
xor ebx, ebx
cmp dword [0x100418a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x10022725
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x10022690
xor eax, eax
jmp 0x100227e9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x10022689
push eax
call fcn.1002b2ee
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100418a8], eax
call esi
push eax
call fcn.1002b2ee
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100418ac], eax
call esi
push eax
call fcn.1002b2ee
mov dword [0x100418b0], eax
lea eax, [ebp - 8]
push eax
call fcn.10005445
test eax, eax
pop ecx
pop ecx
je 0x100226f3
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10005715
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x10022725
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.1002b2ee
cmp eax, ebx
pop ecx
mov dword [0x100418b8], eax
je 0x10022725
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1002b2ee
pop ecx
mov dword [0x100418b4], eax
mov eax, dword [0x100418b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1002279e
cmp dword [0x100418b8], esi
je 0x1002279e
push eax
call fcn.1002435f
pop ecx
call eax
cmp eax, ebx
je 0x1002276b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x100418b8]
call fcn.1002435f
pop ecx
call eax
test eax, eax
je 0x1002276b
test byte [ebp - 0x18], 1
jne 0x1002279e
lea eax, [ebp - 0xc]
push eax
call fcn.10024577
test eax, eax
pop ecx
je 0x10022786
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10005715
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x10022795
or dword [ebp + 0x10], 0x200000
jmp 0x100227cf
or dword [ebp + 0x10], 0x40000
jmp 0x100227cf
mov eax, dword [0x100418ac]
cmp eax, esi
je 0x100227cf
push eax
call fcn.1002435f
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x100227cf
mov eax, dword [0x100418b0]
cmp eax, esi
je 0x100227cf
push dword [ebp - 4]
push eax
call fcn.1002435f
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x100418a8]
call fcn.1002435f
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100259ae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebp
push esi
push edi
xor esi, esi
mov ebp, 0x10041988
push esi
mov ecx, ebp
call fcn.1000547c
mov edi, eax
cmp edi, esi
mov dword [esp + 0xc], 1
je 0x10025a5f
push ebx
test esi, esi
jne 0x10025a5e
mov eax, dword [esp + 0x18]
shr eax, 4
inc eax
movzx eax, ax
push 6
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x10025a45
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10025a07
xor eax, eax
jmp 0x10025a43
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10025a03
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10025a35
cmp esi, eax
jae 0x10025a03
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10025a27
cmp esi, eax
jae 0x10025a03
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
mov esi, eax
push dword [esp + 0x10]
mov ecx, ebp
call fcn.1000547c
inc dword [esp + 0x10]
mov edi, eax
test edi, edi
jne 0x100259d4
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret
Function at 0x1002c087
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0x79f7
mov dword [ebp - 4], 0x3e09
mov eax, dword [ebp - 4]
or eax, 0x1a25
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x597a
mov dword [ebp - 8], 0x2489
mov dword [ebp - 0xc], 0x1306
mov dword [ebp - 4], 0x70c5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
imul eax, eax, 0x3121
sub ecx, eax
add ecx, dword [ebp - 0xc]
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push esi
push 0x10028cd9
push eax
mov dword [ebp - 0xc], ecx
push eax
call fcn.10008a82
mov dword [esi], eax
mov dword [ebp - 0x1c], 0xc35
mov dword [ebp - 8], 0x3d35
mov dword [ebp - 0x10], 0x291a
mov dword [ebp - 0xc], 0x762d
mov dword [ebp - 4], 0x745e
mov dword [ebp - 0x1c], 0x427f
mov dword [ebp - 0x18], 0x5330
mov dword [ebp - 0x14], 0x704f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
sub ecx, eax
add ecx, dword [ebp - 4]
add esp, 0x18
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
imul eax, edx
mov edx, dword [ebp - 0x1c]
imul eax, edx
xor ecx, eax
or ecx, 0xc77
cmp dword [esi], 0xffffffff
mov dword [ebp - 0x1c], ecx
je 0x1002c1d2
mov dword [ebp - 0x1c], 0x2fb9
mov dword [ebp - 0x18], 0x3f2d
mov dword [ebp - 0x1c], 0x3c13
mov dword [ebp - 0x14], 0x174d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
and eax, ecx
mov ecx, dword [ebp - 0x14]
sub ecx, 0x772f
xor eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0x5720
mov dword [ebp - 0x14], 0x157f
mov dword [ebp - 0x18], 0x5b9
mov dword [ebp - 0x1c], 0x7df8
mov dword [ebp - 0xc], 0x19a2
mov dword [ebp - 0x10], 0x5be4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
xor eax, ecx
mov ecx, dword [ebp - 0x14]
xor eax, ecx
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x2f8f
add ecx, dword [ebp - 0xc]
or eax, ecx
mov dword [ebp - 0x1c], eax
mov al, 1
leave
ret
mov dword [ebp - 0x1c], 0x6284
mov dword [ebp - 0x18], 0x1f6d
mov dword [ebp - 0x1c], 0x5b51
mov dword [ebp - 0x14], 0x7bfe
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
imul eax, ecx
mov ecx, dword [ebp - 0x14]
or eax, ecx
or eax, 0x6365
mov dword [ebp - 0x1c], eax
xor al, al
leave
ret
Function at 0x151609
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x151a90
call fcn.001517b4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x152370
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1513c4
cmp eax, esi
jne 0x1513b7
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1513c7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x15139e
xor esi, esi
inc esi
mov eax, dword [0x15236c]
cmp eax, esi
jne 0x1513da
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x151409
mov eax, dword [0x15236c]
test eax, eax
jne 0x151403
mov dword [0x15236c], esi
push 0x1510b8
push 0x1510ac
call fcn.00151300
pop ecx
pop ecx
test eax, eax
je 0x151409
jmp 0x15152d
mov dword [0x152034], esi
mov eax, dword [0x15236c]
cmp eax, esi
jne 0x15142d
push 0x1510a8
push 0x1510a0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x15236c], 2
cmp dword [ebp - 0x20], ebx
jne 0x15143a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x152374], ebx
je 0x15145b
push 0x152374
call fcn.00151729
pop ecx
test eax, eax
je 0x15145b
push ebx
push 2
push ebx
call dword [0x152374]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x15152d
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1514c5
cmp cx, bx
je 0x151480
cmp dword [ebp - 0x1c], ebx
jne 0x1514c5
movzx ecx, word [eax]
cmp cx, bx
je 0x151495
cmp cx, 0x20
ja 0x151495
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x151480
test byte [ebp - 0x40], 1
je 0x1514a1
movzx ecx, word [ebp - 0x3c]
jmp 0x1514a4
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x150000
call main
mov dword [0x152030], eax
cmp dword [0x152024], ebx
jne 0x15150a
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1514d6
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x15146a
cmp dword [0x152034], ebx
jne 0x151518
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x152030]
jmp 0x151539
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.001517f9
ret
call fcn.00151901
jmp 0x151361
Function at 0x4083d5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x408391
add ecx, 0x14594
or ecx, 0x6855
pop ecx
mov ecx, dword [ebp - 0x2f0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
xchg ebp, eax
enter 0xfffffffffffffffc, 0xffffffffffffffff
push eax
sub eax, 0x14313
pop eax
push esi
push ecx
add esp, 4
jmp 0x4083c0
jmp 0x4083c6
call 0x4083d5
add byte [edi], dh
inc ebx
aaa
inc eax
dec ecx
dec ecx
aaa
aaa
cmp byte [ebx - 0x197efb3c], al
sbb bl, byte [ebx]
add byte [esi - 0x39], bl
test dword [eax + 0xfffff8], ecx
add byte [eax], al
add byte [ebx - 0x3377b], cl
dec dword [ecx - 0x16037b]
inc dword [ebx - 0x160343]
inc dword [eax]
jne 0x40840f
mov ecx, dword [ebp - 0x778]
mov dword [ebp - 0x50c], ecx
jmp 0x408700
mov edx, dword [ebp - 0x1604]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1608], eax
jne 0x408437
mov ecx, dword [ebp - 0x778]
mov dword [ebp - 0x50c], ecx
jmp 0x408700
mov edx, 8
imul eax, edx, 0
invalid
Function at 0x40880f
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
les eax, [ecx + eax*4]
into
inc ebx
loopne 0x407b0b
add al, ch
pop es
add byte [eax], al
add byte [eax], al
dec eax
inc ebx
dec edx
inc eax
aaa
cmp eax, dword [ebx + 0x565e04c4]
xor esi, 0x82f5
pop esi
mov edx, dword [ebp - 0x504]
mov dword [ebp - 0x758], edx
jmp 0x407b9a
cmp dword [ebp - 0x758], 0
jne 0x407be4
push eax
and eax, 0x14086
add dword [eax], eax
sub eax, 0xebbc
pop eax
push eax
push edi
add esp, 4
sub eax, 0xb83c
or eax, 0xc4d4
or eax, 0xae34
pop eax
push ecx
push edx
add esp, 4
or ecx, 0x2ef9
pop ecx
mov dword [ebp - 0x7a4], 0
jmp 0x40870c
push ecx
call 0x407bf3
add byte [ebx + 0x4a], cl
aas
xor eax, 0x3a3b4e49
add esp, 4
sub ecx, 0x185e2
push edx
push eax
add esp, 4
sub edx, 0xbcc3
and edx, 0x1524
pop edx
push ebx
or ebx, 0xdc6b
call 0x408734
add byte [0x3e364645], dh
inc ecx
cmp dword [ebx + eax*4], edi
les eax, [ecx + eax*4]
jmp 0x408789
mov ebp, 0xfffff528
add byte [ebp + 0x46], dh
push ecx
or ecx, 0x12752
jmp 0x40879e
add ecx, 0x1aad
pop ecx
push edx
xor edx, 0x7f25
xor edx, 0x4cdd
call 0x4087bf
add byte [edx], dh
cmp dh, byte [0x404e414d]
add esp, 4
pop edx
mov eax, dword [ebp - 0x7a4]
test dword [eax + edi*8 - 1], ebx
dec dword [ecx - 0x19a37b]
jmp [edx]
call dword [ebp - 0x19a4]
mov dword [ebp - 0x203c], 0xa
push ebx
push edi
add esp, 4
or ebx, 0xa6d4
or ebx, 0xc21e
pop ebx
push ebx
add ebx, 0x4d7
jmp 0x408800
pop ebx
push edx
call 0x40880f
add byte [edi + 0x34], cl
aaa
xor eax, 0x83474343
les eax, [edx + ebx*2]
mov ecx, dword [ebp - 0x3fc]
mov dl, byte [ecx + 0xa]
mov byte [ebp - 0x3b0], dl
mov eax, dword [ebp - 0xad8]
sub eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x1690], eax
mov dword [ebp - 0xcf8], 0
push eax
push ecx
add esp, 4
jmp 0x408849
sub eax, 0x155b4
and eax, 0x1634
and eax, 0xeb4d
pop eax
push edx
xor edx, 0x247c
pop edx
push edi
push esi
add esp, 4
sub edi, 0x109e9
pop edi
mov byte [ebp - 0x9dc], 0x56
invalid
call dword [esi - 0x3a]
test dword [0x69fffff6], esp
mov byte [ebp - 0x9da], 0x72
mov byte [ebp - 0x9d9], 0x74
mov byte [ebp - 0x9d8], 0x75
mov byte [ebp - 0x9d7], 0x61
mov byte [ebp - 0x9d6], 0x6c
mov byte [ebp - 0x9d5], 0x50
mov byte [ebp - 0x9d4], 0x72
invalid
push dword [edx - 0x3a]
test dword [0x6ffffff6], ebp
mov byte [ebp - 0x9d2], 0x74
mov byte [ebp - 0x9d1], 0x65
mov byte [ebp - 0x9d0], 0x63
mov byte [ebp - 0x9cf], 0x74
mov byte [ebp - 0x9ce], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x19a8], ecx
mov edx, dword [ebp - 0x19a8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19ac], eax
dec dword [ebx - 0x19ab73]
dec dword [ecx - 0x160f73]
call dword [eax - 0x15]
invalid
sub eax, 0xd079
Function at 0x408e09
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte ds:[ebx + 0x525e04c4], al
push ecx
add esp, 4
or edx, 0x8181
add byte [eax], al
pop edx
push esi
or esi, 0xf6db
pop esi
mov edx, dword [ebp - 0x1984]
mov dword [ebp - 0x1988], edx
lea eax, [ebp - 0x173c]
push eax
call dword [ebp - 0x1988]
test eax, eax
jne 0x408021
push edx
xor edx, 0xcfaa
or edx, 0xf5e0
xor edx, 0x1a0a
pop edx
push edx
push ecx
add esp, 4
or edx, 0x358a
and edx, 0xd1b9
sub edx, 0x168aa
sub edx, 0x318
pop edx
mov dword [ebp - 0x7a4], 0
jmp 0x40870c
pop eax
push edx
xor edx, 0x104dc
or edx, 0x15227
and edx, 0x16337
pop edx
push esi
push ebx
add esp, 4
and esi, 0xf74c
pop esi
mov byte [ebp - 0x8ac], 0x4c
mov byte [ebp - 0x8ab], 0x6f
jmp [edi - 0x3a]
test dword [esi - 9], edx
invalid
jmp dword [ecx - 0x3a]
test dword [edi - 9], edx
invalid
jmp dword [esi + eax*8 - 0x7b]
pop eax
idiv edi
dec dword [esi + eax*8 - 0x7b]
pop ecx
idiv edi
jmp [ecx - 0x3a]
test dword [edx - 9], ebx
invalid
jmp dword [edx - 0x3a]
test dword [ebx - 9], ebx
invalid
push dword [edx - 0x3a]
test dword [edi + esi*8 - 1], ebx
jmp dword [ecx - 0x3a]
test dword [ebp - 9], ebx
invalid
push dword [edx - 0x3a]
test dword [esi - 9], ebx
invalid
invalid
jns 0x408d10
test dword [edi - 9], ebx
invalid
call dword [edi - 0x3a]
test dword [eax - 9], esp
invalid
inc dword [eax]
mov edx, dword fs:[0x18]
mov dword [ebp - 0x19b0], edx
mov eax, dword [ebp - 0x19b0]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x19b4], ecx
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x161c], edx
push ebx
sub ebx, 0xe7a0
pop ebx
push edx
push eax
add esp, 4
jmp 0x408d92
and edx, 0x170a
add edx, 0xacb2
sub edx, 0xd336
pop edx
push ecx
push edx
add esp, 4
add ecx, 0xe41e
pop ecx
cmp dword [ebp - 0x161c], 0
jne 0x408dc9
mov dword [ebp - 0x77c], 0
jmp 0x409070
mov eax, dword [ebp - 0x161c]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xce0], edx
push esi
push eax
add esp, 4
sub esi, 0x9a51
sub esi, 0x13f05
call 0x408df9
add byte [ebp + 0x44], cl
cmp byte [edi + 0x4e], al
cmp byte [edi], dh
add esp, 4
call 0x408e09
add byte [eax], bh
cmp byte [0x3a4a4836], dh
add esp, 4
pop esi
cmp dword [ebp - 0xce0], 0
jne 0x408e25
mov dword [ebp - 0x77c], 0
invalid
dec ebx
add al, byte [eax]

Function at 0x409024
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
push ecx
push eax
add esp, 4
or ecx, 0xa62f
sub ecx, 0xc9fd
pop ecx
mov ecx, dword [ebp - 0x514]
mov edx, dword [ecx]
mov dword [ebp - 0x514], edx
mov eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0xce0]
je 0x409066
mov ecx, dword [ebp - 0x514]
cmp dword [ecx + 0x30], 0
jne 0x408e31
mov dword [ebp - 0x77c], 0
Function at 0x406c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 4]
cmp dword [ecx + 0xcac], 5
jne 0x406c97
push ecx
call fcn.00404100
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [ecx + 0x155c], 0
je 0x406cae
push edi
call fcn.004186d0
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [ecx + 0x40], 0
mov eax, dword [edi + 0x20]
push ebx
mov ebx, dword [edi + 0x24]
push esi
mov esi, dword [edi + 0x14]
mov dword [ebp + 8], eax
je 0x406ccf
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x10]
mov ebx, eax
mov dword [ebp + 8], edx
mov eax, edx
test eax, eax
je 0x406dba
lea edx, [ebx - 0xc]
cmp edx, 0x11f3
ja 0x406dba
push ebx
push eax
push ecx
call fcn.00416e60
add esp, 0xc
test eax, eax
je 0x406dba
xor eax, eax
push 0x18e
push eax
lea ecx, [ebp - 0x1a6]
push ecx
mov dword [ebp - 0x14], 0xc8
mov word [ebp - 0x1a8], ax
call fcn.0041be60
mov edx, dword [edi + 4]
mov edx, dword [edx + 0xcc8]
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1a8]
push ecx
push 0x22
push esi
call edx
test eax, eax
je 0x406dba
mov esi, dword [edi + 4]
push 7
lea eax, [ebp - 0x10]
push eax
add esi, 0x3e34
push esi
mov dword [ebp - 8], 0xa0d0a0d
mov byte [ebp - 4], 0
mov dword [ebp - 0x10], 0x74736f48
mov word [ebp - 0xc], 0x203a
mov byte [ebp - 0xa], 0
call fcn.0041bde0
lea ecx, [ebp - 0x1a8]
push ecx
lea edx, [esi + 6]
push edx
call fcn.0041c480
push 5
lea eax, [ebp - 8]
push eax
push esi
call fcn.0041c1e0
push esi
call fcn.0041c0b0
mov ecx, dword [ebp + 8]
push ebx
mov dword [ebp - 0x18], eax
push ecx
add eax, esi
push eax
call fcn.0041bde0
mov edi, dword [edi + 4]
mov edx, dword [edi + 0x1164]
mov eax, dword [ebp - 0x18]
push edx
push 1
add eax, ebx
push eax
push esi
push edi
call fcn.004163f0
add esp, 0x44
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x407b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x40
push eax
call fcn.0041c0d0
add esp, 4
cmp eax, 0x1000
ja 0x407ccd
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x7d8]
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x407ccb
mov ecx, dword [ebp + 0xc]
push edi
lea edi, [eax + eax]
push edi
add ebx, 0x1fb440
push ebx
push ecx
call fcn.0041c0f0
add esp, 0xc
test eax, eax
jne 0x407cca
mov edx, dword [ebp + 0xc]
push edi
push edx
push ebx
call fcn.0041bde0
add esp, 0xc
xor ecx, ecx
xor eax, eax
push 0x104
mov word [ebp - 8], cx
mov ecx, dword [esi + 0xcc0]
lea edi, [esi + 0x1185c]
push edi
mov dword [ebp - 0x10], 0xa000d
mov dword [ebp - 0xc], 0xa000d
mov dword [ebp - 0x40], 0x6c0043
mov dword [ebp - 0x3c], 0x700069
mov dword [ebp - 0x38], 0x6f0062
mov dword [ebp - 0x34], 0x720061
mov dword [ebp - 0x30], 0x64
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov word [ebp - 0x22], ax
call ecx
mov edx, dword [esi + 0xcbc]
push eax
call edx
cmp eax, 0x40
jbe 0x407c25
xor eax, eax
mov word [esi + 0x118dc], ax
jmp 0x407c54
test eax, eax
jne 0x407c54
push 0x10
lea eax, [ebp - 0x20]
push eax
push edi
mov dword [ebp - 0x20], 0x6e0055
mov dword [ebp - 0x1c], 0x6e006b
mov dword [ebp - 0x18], 0x77006f
mov dword [ebp - 0x14], 0x6e
call fcn.0041bde0
add esp, 0xc
push 0x14
lea ecx, [ebp - 0x40]
push ecx
add esi, 0x120dc
push esi
call fcn.0041bde0
push 0
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.0041c240
push 0
push edi
push esi
call fcn.0041c240
push 0
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.0041c240
mov ecx, dword [ebp + 0xc]
push 0
push ecx
push esi
call fcn.0041c240
push esi
call fcn.0041c0d0
mov edi, dword [ebp - 4]
add esp, 0x40
add eax, eax
push esi
mov dword [edi + 0x208c], eax
call fcn.0041c0d0
add eax, eax
push eax
lea edx, [edi + 0x2094]
push esi
push edx
call fcn.0041bde0
add esp, 0x10
mov dword [edi + 0x2090], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409900
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
rdtsc
xor ecx, ecx
add ecx, eax
rdtsc
sub eax, ecx
mov dword [ebp - 4], eax
mov eax, 0x50
mov esp, ebp
pop ebp
ret