joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48b970
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004676e0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00467760
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00467760
lea ecx, [esi + 0xc]
call fcn.0047ca01
lea ecx, [esi + 0x10]
call fcn.0047ca01
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00469f90
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00469f90
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00469f90
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0047ca76
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0047ca76
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10029f5a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10029f99
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10029f99
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10029f99
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10029f99
cmp dword [ecx + 0x74], 0xe
jbe 0x10029f99
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1002c925
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002c9c2
push ebx
push esi
call fcn.1002c8ee
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002c882
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002c96f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002c9c1
push edi
push eax
call fcn.1002b223
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002c98f
call fcn.1002b271
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002c9c0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002c882
add esp, 0x20
test eax, eax
jne 0x1002c9ae
push edi
call fcn.1002b271
jmp 0x1002c9b6
push ebx
call fcn.1002b271
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1002cc2f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100353c0
push 0x100353b8
push str.FlsAlloc
push 0x1f
call fcn.1002cb4b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002cc63
push dword [ebp + 8]
mov ecx, esi
call dword [0x10033150]
call esi
jmp 0x1002cc69
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002ccad
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100353d0
push 0x100353c8
push str.FlsGetValue
push 0x21
call fcn.1002cb4b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002cce4
push dword [ebp + 8]
mov ecx, esi
call dword [0x10033150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002ccec
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100353d8
push 0x100353d0
push str.FlsSetValue
push 0x22
call fcn.1002cb4b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002cd26
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10033150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10032230
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003225d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003225d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40190b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
invalid
inc ebp

Function at 0x401aa0
Capabilities:
Encrypt data using rc4 prga
Inspect section memory permissions

Disassembly:
cli
invalid
push ebx
call dword [ebp - 0x88]
dec dword [ebx + 0xff33bf0]
test bh, dl
add al, byte [eax]
invalid
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.004014c5
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x401ac4
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
add al, 0xc1
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.004014c5
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x401a91
call fcn.00401554
loope 0x401a4f
jne 0x401a65
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
invalid
invalid

Function at 0x4024c3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00401564
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00401519
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00401554
add eax, esp
dec eax
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.00401554
out 0xa5, eax
invalid
Function at 0x10001940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10001998
cmp byte [esi + ebx - 1], 0xa
je 0x1000196c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10007084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10001fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10002198
mov edi, dword [0x10007084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x100020a7
test byte [0x10003030], 8
jne 0x10002140
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10003040], 8
jne 0x10002100
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10002049
cmp esi, 3
jbe 0x100020b8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1000205a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10005180]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10002049
mov dword [esp], 0x10003040
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10002020
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10002020
mov dword [esp], 0x10003030
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000200b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10002013
mov eax, 0xffffffff
jmp 0x100020a7
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xa6960be
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x41c957ec
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x53966569
nop
nop
nop
nop
test eax, eax
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x464f5890
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x71402c
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x714033
pushal
jmp 0x714039
call 0x714043
sysenter
in eax, dx
imul dword [edx]
pop esi
jmp 0x71404e
add esi, 0xffffffc2
jmp 0x71405e
cmp dword [esi], 0
stc
jb 0x714068
aad 0x76
mov ebx, 0x80840fe2
add byte [eax], al
add al, bh
je 0x7140ee
clc
jmp 0x714073
mov ecx, esi
jae 0x714079
rcl byte [edi - 0x14fb397d]
add al, 0x57
or dword [esi - 0x14f9740c], edx
add ch, cl
mov byte [ebx], 0xc6
add esi, 4
jmp 0x714082
mov eax, dword [esi]
jmp 0x714088
add eax, esi
clc
jae 0x714093
cmp byte [esp + eax*2], bl
add byte [eax], ah
test byte [ebx + 0x6eb0456], 0xa7
xchg edx, eax
scasb al, byte es:[edi]
das
loope 0x7140b8
mov edx, dword [esi + 4]
jmp 0x71409e
sub dword [eax], 0xb412b950
jmp 0x7140ad
add eax, 4
jmp 0x7140b7
sub edx, 1
clc
jmp 0x7140c0
ljmp 0x518f:0x3ebf801
jne 0x714096
jmp 0x7140cb
add esi, 8
jmp 0x7140d2
sub dword [ecx], 1
clc
jae 0x7140d9
jo 0x7140e9
jne 0x71407c
test dword [ebp + 0x73ffffff], ebx
add al, dh
lodsd eax, dword [esi]
jae 0x7140e3
invalid
mov ebx, esi
jmp 0x7140e9
call 0x7140fc
jmp 0x7140f2
popal
jmp 0x7140f7
jmp 0x59fbd6
Function at 0x403280
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427324]
jne 0x40328a
repz ret
jmp fcn.00407330

Function at 0x40a6e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or al, 0x88
pop ebp
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040a3e9
test byte [0x458d1c38], bh
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x40a7a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040a3f9
push eax
push esi
push dword [ebp + 8]
call fcn.0040a3ae
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040a3f9
push eax
push esi
push dword [ebp + 8]
call fcn.0040a3ae
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040a3e9
mov dl, 0x5f
mov ds, word [ebp - 0x836278]
invalid
Function at 0x40aa80
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x40aa9d
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x40aa98
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40aa82
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x40aa8a
cmp edx, ebx
jne 0x40abd8
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x40aa59
add eax, dword [eax + 4]
jmp 0x40aa46
mov dword [ebp + 0xc], ebx
jmp 0x40aaa8
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40aac0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40aade
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40ab3c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40ab23
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40ab2c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40ab36
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40ab18
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40aaa2
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40ab89
dec eax
je 0x40ab80
sub eax, 3
je 0x40ab77
mov dword [ebp - 4], 0x40
jmp 0x40aba6
mov dword [ebp - 4], 4
jmp 0x40ab8c
mov dword [ebp - 4], 0x20
jmp 0x40ab8c
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40abd8
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40ab58
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040a3e9
insd dword es:[edi], dx
mov edi, 0x75ffbfe4
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x40abe4
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40aad0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x40aa9d
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x40aa98
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40aa82
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x40aa8a
cmp edx, ebx
jne 0x40abd8
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x40aa59
add eax, dword [eax + 4]
jmp 0x40aa46
mov dword [ebp + 0xc], ebx
jmp 0x40aaa8
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40aac0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40aade
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40ab3c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40ab23
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40ab2c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40ab36
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40ab18
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40aaa2
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40ab89
dec eax
je 0x40ab80
sub eax, 3
je 0x40ab77
mov dword [ebp - 4], 0x40
jmp 0x40aba6
mov dword [ebp - 4], 4
jmp 0x40ab8c
mov dword [ebp - 4], 0x20
jmp 0x40ab8c
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40abd8
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40ab58
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040a3e9
insd dword es:[edi], dx
mov edi, 0x75ffbfe4
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x40abe4
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ba68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49e390]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov word [ebp - 0x1c], 0x2f
mov word [ebp - 0x1a], 0x2f2f
mov word [ebp - 0x18], 0x2f22
mov word [ebp - 0x16], 0x3a
mov word [ebp - 0x14], 0x2a
mov word [ebp - 0x12], 0x3f
mov word [ebp - 0x10], 0x3c
mov word [ebp - 0xe], 0x3e
mov word [ebp - 0xc], 0x7c
mov word [ebp - 0xa], 0x2f74
mov word [ebp - 8], 0x22
xor esi, esi
movzx eax, word [ebp + esi*2 - 0x1c]
push eax
push edi
call fcn.0045fe7f
test eax, eax
pop ecx
pop ecx
jne 0x40bae4
inc esi
cmp esi, 0xb
jb 0x40babd
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0045eaa1
leave
ret
xor al, al
jmp 0x40bad7

Function at 0x41a0a9
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
push 0xfffffffffffffffe
pop eax
jbe 0x41a0cf
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x488800]
inc ecx
dec edx
jne 0x41a0b2
pop edi
pop esi
ret

Function at 0x41a0d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
xor ecx, ecx
cmp dword [esp + 8], eax
jbe 0x41a0fb
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4a0568]
inc ecx
cmp ecx, dword [esp + 8]
jb 0x41a0da
ret

Function at 0x41a52c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
call fcn.0041a0a9
mov ecx, dword [ebp + 8]
xor edx, edx
cmp dword [ebp + 0xc], edx
mov esi, eax
jle 0x41a55e
lea eax, [edx + esi]
and eax, 0x3ff
mov al, byte [eax + 0x4a92e0]
xor byte [ecx], al
inc ecx
inc edx
cmp edx, dword [ebp + 0xc]
jl 0x41a547
mov eax, esi
pop esi
pop ebp
ret

Function at 0x41be85
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov edx, ebx
mov ecx, edi
call fcn.0041a0a9
mov dword [ebp - 4], eax
xor eax, eax
test ebx, ebx
jbe 0x41bec0
mov esi, dword [ebp + 0xc]
add esi, 0x523
mov ecx, esi
and ecx, 0x3ff
mov cl, byte [ecx + 0x488800]
xor byte [eax + edi], cl
inc eax
inc esi
cmp eax, ebx
jb 0x41bea9
xor esi, esi
test ebx, ebx
jbe 0x41beed
xor edx, edx
push 7
pop ecx
mov eax, esi
div ecx
mov bl, byte [esi + edi]
inc edx
mov ecx, edx
and ecx, 0x80000007
jns 0x41bee2
dec ecx
or ecx, 0xfffffff8
inc ecx
rol bl, cl
mov byte [esi + edi], bl
inc esi
cmp esi, dword [ebp + 8]
jb 0x41bec6
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret