joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x419cf8
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x419cf0
cmp ebx, ebp
ja 0x419d65
cmp ebp, dword [esp + 0x1c]
ja 0x419d71
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x419cf2
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x419ce0
jmp 0x419d4e
ja 0x419cf8
cmp edx, edi
mov ebx, ebp
jne 0x419cb5
mov eax, dword [esp + 0x24]
test eax, eax
je 0x419d52
mov esi, dword [esp + 0x20]
cmp eax, 1
movzx ecx, cx
mov ebx, esi
lea edi, [esi + eax]
mov al, 1
sbb ebx, 0xffffffff
nop word cs:[eax + eax]
nop
movzx edx, byte [esi]
test dl, dl
jns 0x419d37
cmp ebx, edi
je 0x419d5b
movzx esi, byte [ebx]
and edx, 0x7f
inc ebx
shl edx, 8
or edx, esi
mov esi, ebx
sub ecx, edx
js 0x419d54
xor al, 1
xor ebx, ebx
cmp esi, edi
setne bl
add ebx, esi
cmp esi, edi
jne 0x419d20
jmp 0x419d54
xor eax, eax
jmp 0x419d54
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x422ca4
call fcn.0041ccd0
push 0x422cb4
push ebp
push ebx
call fcn.0041d0b0
push 0x422cb4
push dword [esp + 0x20]
push ebp
call fcn.0041d090
Function at 0x41ba77
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41bab6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41bab6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41bab6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41bab6
cmp dword [ecx + 0x74], 0xe
jbe 0x41bab6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41cef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x41cf41
cmp eax, 1
jne 0x41cfbe
mov dword [esp], 0x4225b8
jmp 0x41cf48
mov dword [esp], 0x4225b6
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x41cfda
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x4225f4
mov dword [esp + 0x3c], 3
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x418300
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x4182e0
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x4182e0
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.0041cd00
mov edx, 7
mov dword [esp], 0x4225ba
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x41cf5d
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 0x50]
mov dword [esp + 0x38], 0x422628
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 8]
mov dword [esp + 0x1c], 0x418300
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x4171f0
lea esi, [esp + 0x10]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x4182e0
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x4182e0
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.0041cd00
int3
Function at 0x407760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section..data
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407778
mov eax, 1
add ebx, ebx
jne 0x40779b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
ja 0x407790
jne 0x4077ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407790
xor ecx, ecx
sub eax, 3
jb 0x4077c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x407832
mov ebp, eax
add ebx, ebx
jne 0x4077cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4077d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4077fc
inc ecx
add ebx, ebx
jne 0x4077e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
ja 0x4077dd
jne 0x4077f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4077dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jle 0x40781c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40780d
jmp 0x40777e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40781c
add edi, ecx
jmp 0x40777e
pop esi
sub edi, dword [edi - 4]
push edi
mov edi, esi
mov ecx, 0x57
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40783e
cmp byte [edi], 0
jne 0x40783e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x407843
pop edi
mov eax, dword [edi]
or eax, eax
je 0x4078ab
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7568]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x75b8]
xchg edx, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40786b
push edx
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push edx
call dword [esi + 0x75bc]
pop edx
or eax, eax
je 0x4078a9
mov dword [ebx], eax
add ebx, 4
jmp 0x407888
popal
ret
lea ebx, [esi - 4]
add edi, 4
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4078dc
cmp al, 0xef
ja 0x4078cf
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4078b1
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4078be
popal
jmp section..text
Function at 0x462990
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4a7ff8]
xor eax, ebp
mov dword [ebp - 4], eax
push 6
lea eax, [ebp - 0xc]
push eax
movzx eax, word [ebp + 8]
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4629d8
push 0xa
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.00470ef2
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d049
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0046d049
mov esp, ebp
pop ebp
ret

Function at 0x468c90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
test ebx, ebx
je 0x468d2e
mov edi, dword [ebp + 8]
test edi, edi
je 0x468d2e
push 0x40
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x468d2e
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x468d2e
push esi
mov esi, dword [edi + 0x3c]
push pe_nt_image_headers32
add esi, edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x468d1d
cmp dword [esi], 0x4550
jne 0x468d1d
mov eax, dword [esi + 0x80]
test eax, eax
je 0x468d27
lea esi, [eax + edi]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x468d0e
add eax, edi
push ebx
push eax
call fcn.0046f8b1
add esp, 8
test eax, eax
je 0x468d0e
mov eax, dword [esi + 0x20]
add esi, 0x14
test eax, eax
jne 0x468cf4
xor eax, eax
cmp dword [esi + 0xc], eax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push 0x57
call dword [sym.imp.USER32.dll_SetLastErrorEx]
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
push 1
push 0x57
call dword [sym.imp.USER32.dll_SetLastErrorEx]
pop edi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x4690d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4aca38]
push edi
test eax, eax
je 0x469149
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x469149
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x469149
push esi
mov esi, dword [ebp + 0xc]
push 5
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x469131
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x469131
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x469131
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
pop esi
pop edi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x54]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0x18
xor eax, eax
pop edi
pop ebp
ret 0x18
Function at 0x1005a7ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
bt si, 5
clc
push 0x3a37e2a9
sub edi, 4
jmp 0x100562f6
movsx ax, al
lea eax, [esi*8 - 0x2ca03bf4]
mov eax, dword [esp + 0x48]
jmp 0x10059899
call fcn.1005ab23
pushfd
dec eax
test ebx, eax
jmp 0x1005a574
mov word [esp], 0x9419
push dword [edi]
pop dword [esp]
jmp 0x10058a71
lea esp, [esp + 0x30]
call fcn.1005a70c
jmp 0x100598c4
bts bx, ax
pushal
mov bx, word [esi]
cmc
test cl, 0x9e
call fcn.10057bc5
test bl, dh
cmp edi, ebx
jmp 0x1006053d
lea esp, [esp + 0x4c]
ja 0x1005a7a2
push 0x9af5b14e
lea esp, [esp + 4]
jb 0x100614bd
test ax, 0x4b7b
cmp bh, ah
pushal
cmp ch, bh
cmp byte [edi - 1], 0
call fcn.1007917f
call fcn.1005b1ea
cmp ebx, 1
push esi
pushal
lea esp, [esp + 0x28]
je 0x1005ad57
cmp ch, bh
cmp ebx, 2
push edx
jmp 0x1006081e
push dword [esp]
pushal
dec al
clc
rol al, 1
mov byte [esp], 0x32
neg al
jmp 0x1005d2fa
shl eax, 8
setl al
lodsb al, byte [esi]
jmp 0x1005a177
sub ch, byte [esi + 0x5e]
xchg edi, eax
pop ebx
sahf
push edx
imul esp, dword [ecx*4 - 0x7474b8a8], 0xffffff97
xchg edi, eax
cmc
pop ebp
in eax, 0x98
jno 0x1005a77b
xor eax, 0x6561445d
sahf
sub byte [esi + 0x35bac73f], 0xf0
stosd dword es:[edi], eax
salc
add esp, ebx
cmpsd dword [esi], dword es:[edi]
mov byte [0xae2368ed], al
and eax, 0x578440ee
or ebx, dword [ecx + 0x4d3bf554]
cld
push esp
cmc
cmp ecx, dword [ebp - 4]
call fcn.1006059b
lea esp, [esp + 0x10]
ja 0x10047242
rcr al, cl
shl al, 5
rol al, 5
call fcn.10058cf6
fdivr st(0)
cmp ebp, dword [esi]
mov bh, 0xc4
jbe 0x1005a76d
ret
bsf bx, sp
inc bh
mov bx, word [esi]
cmc
cmc
and ebx, 0xfff
clc
call fcn.1005784b
pushal
cmp dh, ch
cmp al, byte [edi]
lea eax, [edx*8 - 0x34c6fa2e]
movsx ax, dl
lea edi, [edi + 1]
push dword [esp + 4]
jmp 0x1005452b
push esp
mov dword [esp], 0x995592e8
push esi
push dword [esp]
push dword [esp]
mov dword [esp + 8], 0x52d709bc
mov byte [esp + 4], dl
lea esp, [esp + 8]
jmp 0x1007a60d
Function at 0x4041c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xc4
mov eax, dword [0x438ab4]
xor eax, esp
mov dword [esp + 0xc0], eax
xor eax, eax
push ebp
push edi
push 0x9c
push eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x34]
mov dword [esi], 0xa
push eax
mov dword [ebx], 5
call fcn.004108c0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], 0x9c
call edi
mov ebp, eax
test ebp, ebp
jne 0x404262
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], 0x94
call edi
test eax, eax
jne 0x404262
pop edi
xor al, al
pop ebp
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0040f653
add esp, 0xc4
ret
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x3c]
sub eax, 0
je 0x404390
sub eax, 1
je 0x40433b
sub eax, 1
jne 0x404396
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 8]
mov cl, byte [esp + 0xc6]
cmp edi, 6
jne 0x4042b0
cmp dword [esp + 0x34], eax
jne 0x4042fb
cmp cl, 1
setne al
mov dword [esi], eax
jmp 0x4042fb
cmp edi, 5
jne 0x4042f0
mov eax, dword [esp + 0x34]
cmp eax, 2
jne 0x4042d7
cmp cl, 1
jne 0x4042cf
cmp dx, 9
jne 0x4042cf
mov dword [esi], edi
mov dword [ebx], eax
jmp 0x4042fb
mov dword [esi], 2
jmp 0x4042fb
cmp eax, 1
jne 0x4042e4
mov dword [esi], 5
jmp 0x4042fb
test eax, eax
jne 0x4042fb
mov dword [esi], 3
jmp 0x4042fb
cmp edi, 4
ja 0x4042fb
mov dword [esi], 4
test ebp, ebp
je 0x404396
cmp cl, 1
jne 0x404396
cmp dx, 9
je 0x404396
cmp edi, 4
jne 0x404323
mov dword [ebx], 0
jmp 0x404396
mov ecx, dword [esp + 0xc4]
and ecx, 0x200
neg ecx
sbb ecx, ecx
add ecx, 2
mov dword [ebx], ecx
jmp 0x404396
cmp dword [esp + 0x30], 4
jne 0x404396
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x404364
mov al, byte [esp + 0x41]
mov dword [esi], 7
cmp al, 0x43
je 0x40435c
cmp al, 0x42
jne 0x404396
mov dword [ebx], 4
jmp 0x404396
cmp eax, 0xa
jne 0x404383
mov al, byte [esp + 0x41]
mov dword [esi], 6
cmp al, 0x41
je 0x40437b
cmp al, 0x42
jne 0x404396
mov dword [ebx], 3
jmp 0x404396
cmp eax, 0x5a
jne 0x404396
mov dword [esi], 8
jmp 0x404396
mov dword [esi], 9
mov ecx, dword [esp + 0xc8]
pop edi
pop ebp
xor ecx, esp
mov al, 1
call fcn.0040f653
add esp, 0xc4
ret

Function at 0x41309f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
cmc
fcmovb st(0), st(6)
inc ebp
neg dl
Function at 0x4130b5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmc
fcmovb st(0), st(6)
inc ebp
neg dl
mov byte [ebp - 9], 0xbf
call fcn.00412d27
push eax
push esi
push dword [ebp + 8]
call fcn.00412cdc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
invalid

Function at 0x413113
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call dword [eax - 0x18]
sbb al, 0xfb
invalid

Function at 0x413174
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
push 0xfffffffffffffffc
push eax
call edi
mov ecx, esi
mov ebx, eax
call fcn.0040abdf
mov eax, dword [esi + 0x20]
push 0xfffffffffffffffc
push eax
call edi
cmp eax, ebx
jne 0x40aec5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf8]
mov eax, dword [eax]
test eax, eax
je 0x40aec5
push eax
push 0xfffffffffffffffc
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, esi
call fcn.0040ad0e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x11c]
pop edi
pop esi
pop ebx
leave
ret
mov byte [ebp - 0x1c], 0x2b
call fcn.00412d27
push eax
push esi
push dword [ebp + 8]
call fcn.00412cdc
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00412d17
sub dword [edi - 0x3f], 0x56
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
invalid
inc ebp
Function at 0x413233
Capabilities:
Encrypt data using rc4 prga
Inspect section memory permissions

Disassembly:
adc byte [eax], al
add bh, bh
jne 0x413234
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je fcn.00413510
test bh, dl
add al, byte [eax]
add bh, bh
mov ch, 0x4c
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.00412c88
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x413287
xor ecx, dword [edi]
mov bh, 0x45
or al, 0x8b
dec ebp
mov esp, 0xff80048d
je 0x413222
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00412c88
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x413254
adc byte [ebp + 0x488bc104], cl
adc al, 0x8b
inc eax
or al, 3
dec ebp
adc byte [ebx], al
invalid
call fcn.00412d17
sbb ch, al
jecxz 0x413253
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x413506
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x4132bc
cmp dword [eax + 0xc], ebx
je 0x41335f
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.00412d17
cmp eax, 0x5d397992
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
call fcn.00412d17
jno 0x4133a8
inc ebx
push es
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x4133cb
add eax, esi
cmp dword [eax], ebx
je 0x4133cb
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x4133c6
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x4133b0
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x4133b8
cmp edx, ebx
jne 0x413506
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x413387
add eax, dword [eax + 4]
jmp 0x413374
mov dword [ebp + 0xc], ebx
jmp 0x4133d6

Function at 0x413410
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
Function at 0x4140f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00412c88
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x414124
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x41416d
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x414117
call fcn.00412d17
cmp esi, 3
push eax
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00412d17
out dx, al
mov ss, word [eax + 0x36]
lea eax, [ebp - 0x72c]
push eax
call fcn.00412d27
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00412cdc
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.00412d17
adc dword [edi - 0x3f], esi
test dword [ebp - 0x7177b], ecx
call dword [eax + 0x6a]
inc eax
push 5
push dword [ebp - 0x3a8]
Function at 0x1003a530
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x1003a561
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1003a561
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x1003a561
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10050156
Capabilities:
Encode data using xor

Disassembly:
call 0x100500cf
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x100500ff
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1005011b
xor edx, 0
jmp 0x10050126
xor edx, edx
jmp 0x1005013d
jmp 0x10050149
xor eax, eax
push 0x8427d7c0
call 0x10050156
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x10050192
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1005016b
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x100501a9
add eax, 0
jno 0x100501ae
add esi, 0
ret 0x10
Function at 0x10050f17
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x10050f39
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x100510db
cmp edi, dword [ebp + 0x10]
jb 0x100510db
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.10050a03
inc edi
jmp 0x10050fc2
jmp 0x10050fcf
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10050a03
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10050a03
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x10051023
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x10051007
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.10051051
add dword [eax], 0x39
jle 0x1005102d
sub al, 0xf5
mov ch, al
call fcn.10051066
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10

Function at 0x10052d3e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x10052d54
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x10052d65
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.10052da6
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx