joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034ea0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10034e99
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10034eb7
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edi, es
add al, 1
add byte [eax], al
mov edi, es
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10034f15
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10034efc
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10034f05
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10034f0f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10034ef1
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10034e7b
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10034f62
dec eax
je 0x10034f59
sub eax, 3
je 0x10034f50
mov dword [ebp - 4], 0x40
jmp 0x10034f7f
mov dword [ebp - 4], 4
jmp 0x10034f65
mov dword [ebp - 4], 0x20
jmp 0x10034f65
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10034fb1
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10034f31
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100347c2
jmp 0x10034fb9
push 0x8000
push ebx
push esi
call dword [ebp - 8]
push ebp
clc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40288e
pop dword [ebp - 8]
mov eax, 0x40288e
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xa07244a1
add dword [ebp - 0x18], 0xade000aa
mov dword [ebp - 0x14], 0xf2825576
sub dword [ebp - 0x14], 0xc04f0931
mov dword [ebp - 0x10], 0x9aee823a
add dword [ebp - 0x10], 0xb15dc1f4
mov dword [ebp - 0xc], 0x51d6e161
sub dword [ebp - 0xc], 0x51d6e161
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xd1521f41
sub dword [ebp - 0x18], 0x5cdfb5eb
mov dword [ebp - 0x14], 0xb411c8c6
add dword [ebp - 0x14], 0x8d5a98af
mov dword [ebp - 0x10], 0xc0328132
sub dword [ebp - 0x10], 0x5cc314c6
mov dword [ebp - 0xc], 0xb465c3d
sub dword [ebp - 0xc], 0xb465c3d
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x1a43dc28
add eax, 0xe5fca4ac
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3c996
push 0
call eax
mov ecx, 0x6003
xor esi, esi
add esi, eax
mov edx, 0xbd6573c
add edx, 0xf46ab8c4
add edx, dword [ebp - 8]
mov edi, 0xcdd87e70
add edi, 0x526011b1
mov dword [ebp - 4], 0x6a694e28
mov ebx, dword [edx]
add dword [ebp - 4], edx
xor ebx, edi
mov dword [ebp - 4], 0x6b9900a1
mov dword [esi], ebx
sub dword [ebp - 4], edi
add esi, 0x848b6298
add esi, 0x7b749d6c
add edx, 0x3bdc561d
sub edx, 0x3bdc5619
loop 0x4029a2
add eax, 0xf78cb689
add eax, 0x874bc56
mov ebx, eax
add eax, 5
mov ecx, 0x1fe8ef7a
sub ecx, 0x1fa8ef7a
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x100046a1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001c680]
jne 0x100046ab
repz ret
jmp fcn.1000913c

Function at 0x10011104
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001c680]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10009c5f
and dword [ebp - 0x14], 0
cmp dword [0x1001e594], 0
mov dword [ebp - 0x18], eax
jne 0x100111b7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1001125f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1001125f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1001e594], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1001e598], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1001e59c], eax
call edi
push eax
call esi
mov dword [0x1001e5a4], eax
test eax, eax
je 0x100111b7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1001e5a0], eax
mov eax, dword [0x1001e5a0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10011210
cmp dword [0x1001e5a4], ecx
je 0x10011210
push eax
call esi
push dword [0x1001e5a4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10011210
test ebx, ebx
je 0x10011210
call edi
test eax, eax
je 0x10011207
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10011207
test byte [ebp - 8], 1
jne 0x10011210
or dword [ebp + 0x10], 0x200000
jmp 0x10011243
mov eax, dword [0x1001e598]
cmp eax, dword [ebp - 0x18]
je 0x10011243
push eax
call esi
test eax, eax
je 0x10011243
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10011243
mov eax, dword [0x1001e59c]
cmp eax, dword [ebp - 0x18]
je 0x10011243
push eax
call esi
test eax, eax
je 0x10011243
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1001e594]
call esi
test eax, eax
je 0x1001125f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10011261
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100046a1
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40c20d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a548]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00409883
mov dword [ebp - 0x14], eax
cmp dword [0x459fd8], esi
jne 0x40c300
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c28d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c3e0
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c3e0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c3e0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x459fd8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x459fdc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x459fe0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x459fe8], eax
test eax, eax
je 0x40c2fd
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x459fe4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c325
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c318
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c33a
push 4
pop eax
jmp 0x40c3e2
cmp dword [ebp - 0x14], esi
je 0x40c33a
push dword [0x459fd8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c31f
mov eax, dword [0x459fe4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c398
cmp dword [0x459fe8], edi
je 0x40c398
push eax
call ebx
push dword [0x459fe8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c398
test eax, eax
je 0x40c398
call ecx
test eax, eax
je 0x40c38d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c38d
test byte [ebp - 8], 1
jne 0x40c398
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c3c8
mov eax, dword [0x459fdc]
cmp eax, edi
je 0x40c3c5
push eax
call ebx
test eax, eax
je 0x40c3c5
call eax
mov esi, eax
test esi, esi
je 0x40c3c5
mov eax, dword [0x459fe0]
cmp eax, edi
je 0x40c3c5
push eax
call ebx
test eax, eax
je 0x40c3c5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x459fd8]
call ebx
test eax, eax
je 0x40c3e0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c3e2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404320
mov esp, ebp
pop ebp
ret
Function at 0x1000b340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000b34f
pop dword [ebp - 0x44]
mov eax, 0x5d28894c
add eax, 0xb2d82a03
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3fbe0
push 0
mov eax, 0x96cd14a6
add eax, 0x79357c66
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x7b64e672
add ecx, 0x849b75aa
xor edi, edi
add edi, eax
mov ebx, 0xd16c5820
add ebx, 0x3e9813e0
add ebx, dword [ebp - 0x44]
mov esi, 0x59cd23de
sub dword [ebp - 0x20], ecx
mov edx, dword [ebx]
xor dword [ebp - 0x30], edi
sub edx, esi
sub dword [ebp - 0x40], edx
mov dword [edi], edx
add dword [ebp - 4], edx
add edi, 0xcab10275
sub edi, 0xcab10271
add ebx, 4
loop 0x1000b3aa
add eax, 0x7405584f
sub eax, 0x7403f50c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x6031a2c9
sub ecx, 0x5031a2c9
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40d21d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419c98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a511
mov dword [ebp - 0x14], eax
cmp dword [0x435504], esi
jne 0x40d310
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d29d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d3f0
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d3f0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d3f0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x435504], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x435508], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43550c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x435514], eax
test eax, eax
je 0x40d30d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x435510], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d335
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d328
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d34a
push 4
pop eax
jmp 0x40d3f2
cmp dword [ebp - 0x14], esi
je 0x40d34a
push dword [0x435504]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d32f
mov eax, dword [0x435510]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d3a8
cmp dword [0x435514], edi
je 0x40d3a8
push eax
call ebx
push dword [0x435514]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d3a8
test eax, eax
je 0x40d3a8
call ecx
test eax, eax
je 0x40d39d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d39d
test byte [ebp - 8], 1
jne 0x40d3a8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d3d8
mov eax, dword [0x435508]
cmp eax, edi
je 0x40d3d5
push eax
call ebx
test eax, eax
je 0x40d3d5
call eax
mov esi, eax
test esi, esi
je 0x40d3d5
mov eax, dword [0x43550c]
cmp eax, edi
je 0x40d3d5
push eax
call ebx
test eax, eax
je 0x40d3d5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x435504]
call ebx
test eax, eax
je 0x40d3f0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d3f2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004045d8
mov esp, ebp
pop ebp
ret
Function at 0x436650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x43665f
pop dword [ebp - 0x1c]
mov eax, 0x89c141b9
add eax, 0x768224a6
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x4ef40
push 0
mov eax, 0x6a5eb4b9
sub eax, 0x6a1af261
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x712425fe
sub ecx, 0x7123d7d8
mov edx, eax
mov ebx, 0x46096ce3
add ebx, 0xba3d451d
add ebx, dword [ebp - 0x1c]
mov edi, 0xa26e6963
add edi, 0xbcb80684
add dword [ebp - 8], ebx
mov esi, dword [ebx]
sub dword [ebp - 4], eax
add esi, edi
add dword [ebp - 0x14], eax
mov dword [edx], esi
xor dword [ebp - 8], edi
add edx, 0x87947ec3
sub edx, 0x87947ebf
add ebx, 0xf18a593e
sub ebx, 0xf18a593a
loop 0x4366be
add eax, 0x12b6b
xor ebx, ebx
add ebx, eax
add eax, 0xdbd93833
sub eax, 0xdbd9382e
mov ecx, 0x5844ed2b
add ecx, 0xa7fb12d5
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x404f72
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00404c4d
aad 0x69
sub dword [ebx + 0x50c0458d], edi
call fcn.00404c5d
push eax
push esi
push dword [ebp + 8]
call fcn.00404c12
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00404c4d
add al, 0x70
cmp dl, byte [eax - 0x73]
inc ebp
call 0x5128ad43
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00404c5d
push eax
push esi
push dword [ebp + 8]
call fcn.00404c12
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00404c5d
push eax
push esi
push dword [ebp + 8]
call fcn.00404c12
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00404c5d
push eax
push esi
push dword [ebp + 8]
call fcn.00404c12
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00404c4d
push ss
push eax
fld dword [ebx - 0x78]
popfd
jl 0x4050d2
invalid
invalid
Function at 0x406025
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
cld
invalid
call dword [eax - 0x18]
jge 0x40602a
invalid
inc dword [ebx - 0x5a7cf33c]
add cl, bh
invalid
inc dword [eax]
jmp 0x40605a
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x4060a3
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x40604d
call fcn.00404c4d
out 0x1f, al
sal dword [edi - 0x72b5a80], 0xff
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
invalid
test esp, ebx
Function at 0x10013074
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10013083
pop dword [ebp - 0x40]
mov eax, 0x18c2ab57
add eax, 0xf73e852c
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xfd1e7c19
sub dword [ebp - 0x50], 0xaecc36ce
mov dword [ebp - 0x4c], 0x87ae5b79
add dword [ebp - 0x4c], 0xaa84f0cc
mov dword [ebp - 0x48], 0x9660d84b
add dword [ebp - 0x48], 0xb5eb6be3
mov dword [ebp - 0x44], 0x6fabba0d
sub dword [ebp - 0x44], 0x6fabba0d
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x43d3be00
sub dword [ebp - 0x50], 0xcf6154aa
mov dword [ebp - 0x4c], 0xb2e62b04
sub dword [ebp - 0x4c], 0x7179c98f
mov dword [ebp - 0x48], 0x2d411a14
sub dword [ebp - 0x48], 0xc9d1ada8
mov dword [ebp - 0x44], 0x6bd134d0
add dword [ebp - 0x44], 0x942ecb30
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3d52c
push 0
call eax
mov ecx, 0x8eb2ec99
add ecx, 0x714d6e26
mov esi, eax
mov edx, 0x33aea1ae
sub edx, 0x23aa85ae
add edx, dword [ebp - 0x40]
mov ebx, 0x96b21a62
sub ebx, 0x820e1701
xor dword [ebp - 0x20], edi
mov edi, dword [edx]
xor dword [ebp - 0x20], 0xe1fab9a9
sub edi, ebx
xor dword [ebp - 8], esi
mov dword [esi], edi
sub dword [ebp - 0x24], edx
add esi, 0x6f895fd4
add esi, 0x9076a030
add edx, 0x507683dd
add edx, 0xaf897c27
loop 0x1001319b
add eax, 0xa0103533
add eax, 0x5ff1289c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5ae21ec7
sub ecx, 0x4ae21ec7
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x10004e9c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005b284
call fcn.1005ab18
sub esp, 0x10
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10004ed8
mov esi, dword [ebp + 0x10]
mov dword [esi], 0
jmp 0x10004ece
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esi]
cmp dword [esi], 2
jl 0x10004ec1
jmp 0x10004f6a
mov dword [ebp - 0x18], 0x2c96
cmp dword [ebp - 0x18], 0x2ce1
jle 0x10004f2b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x10075eb8
xor eax, esi
cdq
push edx
push eax
call fcn.10001edd
inc ebx
cmp ebx, 0x5c84
jl 0x10004efb
inc edi
cmp edi, 0x41d5
jl 0x10004ef9
inc esi
cmp esi, 0x331a
jl 0x10004ef7
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x29eb
jge 0x10004f47
mov edx, str.bcovpymd_byvdlhjz_ylzhvbooc
mov ecx, 0x10075eb8
call fcn.10003d9f
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x10004f6a
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xf9af3922
inc dword [edx]
cmp dword [edx], 4
jl 0x10004f58
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000533d
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 8], dl
test dl, dl
je 0x10005368
push 1
push ecx
push 0x192e
lea edx, [ebp - 1]
mov byte [ebp - 1], 0
mov ecx, 0x125
call fcn.10004ad7
add esp, 0xc
jmp 0x10005370
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov esp, ebp
pop ebp
ret