joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d25c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
xor esi, esi
mov edi, dword [ebx + 0x4804]
mov dword [ebx + eax*4 + 0x4808], edi
movzx ecx, word [ebx]
mov eax, ecx
mov dword [esp + 0xc], edi
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x76d368]
movzx edx, byte [ecx + 0x76d368]
movzx ecx, word [ebx + 2]
mov dword [esp + 0x10], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x76d368]
add eax, edx
mov dword [esp + 0x14], eax
movzx eax, byte [ecx + 0x76d368]
mov ecx, dword [esp + 0x28]
add eax, edx
mov dword [esp + 0x1c], eax
imul eax, ecx, 0x440
add eax, 0x404
add eax, ebx
mov dword [esp + 0x24], eax
test edi, edi
je 0x6d276c
lea eax, [ecx*8]
push ebp
mov dword [esp + 0x1c], eax
mov ebp, eax
nop dword [eax + eax]
cmp esi, 8
jae 0x6d26bd
xor edi, edi
lea edx, [esi + 8]
lea ebp, [ecx*8]
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 4]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x76d368]
add edi, eax
cmp edx, 1
jne 0x6d2671
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add eax, edi
mov edi, dword [esp + 0x10]
mov dword [ecx + esi*4], eax
inc esi
mov ecx, dword [esp + 0x2c]
cmp esi, edi
jb 0x6d2660
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
cmp esi, edi
jae 0x6d276b
cmp esi, 0x10
jae 0x6d271d
xor edi, edi
mov edx, esi
nop
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 0x104]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x76d368]
add edi, eax
cmp edx, 1
jne 0x6d26d0
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [esp + 0x10]
jb 0x6d26c5
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov ebp, dword [esp + 0x28]
xor edi, edi
lea eax, [esi + 0xf0]
nop dword [eax]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x204]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x76d368]
add edi, ecx
cmp eax, 1
jne 0x6d2730
mov eax, dword [esp + 0x20]
add eax, edi
mov dword [ebp + esi*4], eax
inc esi
cmp esi, dword [esp + 0x10]
jb 0x6d2721
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x6d5490
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov edx, 0x3700
mov dword [esp + 0x24], edx
lea esi, [edi + 0x10598]
lea ebp, [edi + 0x10194]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebp
nop dword [eax + eax]
mov eax, dword [edi + 0x10d94]
xor ebx, ebx
test eax, eax
je 0x6d5524
nop dword [eax]
mov ebp, dword [esp + 0x24]
lea eax, [ebx + 0x40]
xor esi, esi
nop dword [eax]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
lea ecx, [eax + ebp]
and edx, 0x7f
movzx ecx, word [edi + ecx*2]
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x76d368]
add esi, ecx
cmp eax, 1
jne 0x6d54e0
mov ebp, dword [esp + 0x10]
mov dword [ebp + ebx*4], esi
inc ebx
mov eax, dword [edi + 0x10d94]
cmp ebx, eax
jb 0x6d54d0
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
mov ecx, 0xe
cmp eax, ecx
jbe 0x6d5547
nop dword [eax]
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [ebp + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x10d94]
jb 0x6d5530
mov eax, dword [ebp]
add edx, 0x40
mov dword [esi - 4], eax
mov eax, dword [ebp + 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
add ebp, 0x100
mov dword [esi + 8], eax
add esi, 0x200
mov dword [esp + 0x24], edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
cmp edx, 0x3800
jb 0x6d54c0
mov ebp, 4
lea eax, [edi + 0x107a4]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x18], eax
nop dword [eax + eax]
movzx ebx, byte [ebp + 0x76d3e8]
mov eax, ebx
mov edx, ebx
shr eax, 1
and edx, 1
dec eax
or edx, 2
mov ecx, eax
mov dword [esp + 0x10], eax
shl edx, cl
mov eax, 1
mov ecx, dword [esp + 0x24]
sub ebp, edx
mov dword [esp + 0x1c], edx
xor esi, esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ecx
sub eax, ebx
mov edx, ebp
add eax, dword [esp + 0x1c]
and edx, 1
shr ebp, 1
movzx ecx, word [edi + eax*2 + 0x6ffe]
mov eax, edx
neg eax
shr ecx, 4
shr eax, 4
and eax, 0x7f
xor ecx, eax
movzx eax, byte [ecx + 0x76d368]
add esi, eax
sub dword [esp + 0x10], 1
mov eax, dword [esp + 0x14]
lea eax, [edx + eax*2]
mov dword [esp + 0x14], eax
jne 0x6d55d5
mov edx, dword [esp + 0x18]
mov eax, dword [edi + ebx*4 + 0x10194]
mov ebp, dword [esp + 0x24]
add eax, esi
inc ebp
mov dword [edx - 0x200], eax
mov eax, dword [edi + ebx*4 + 0x10294]
add eax, esi
mov dword [esp + 0x24], ebp
mov dword [edx], eax
mov eax, dword [edi + ebx*4 + 0x10394]
add eax, esi
mov dword [edx + 0x200], eax
mov eax, dword [edi + ebx*4 + 0x10494]
add eax, esi
mov dword [edx + 0x400], eax
add edx, 4
mov dword [esp + 0x18], edx
cmp ebp, 0x80
jb 0x6d55a0
mov dword [edi + 0x10d98], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x6d5680
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ecx, 8
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov edx, dword [edi + 0xa98]
lea ebp, [edi + 0xaa0]
mov eax, dword [edi + 0xa9c]
sub ecx, edx
and eax, dword [esp + 0x18]
shr esi, cl
mov ecx, edx
shl eax, cl
add esi, eax
imul eax, esi, 0x600
add ebp, eax
cmp byte [esp + 0x20], bl
jne 0x6d56d5
push dword [esp + 0x28]
push 8
push ebp
call fcn.006d6dd0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [esp + 0x28]
mov esi, 0x100
mov edi, dword [esp + 0x24]
add edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
shr eax, 8
add ecx, esi
add eax, ecx
movzx ecx, word [ebp + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor ecx, eax
movzx eax, byte [ecx + 0x76d368]
mov ecx, edi
xor ecx, edx
add ebx, eax
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x6d56e4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x6d6dd0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 0xc]
push edi
xor edi, edi
add ecx, eax
mov eax, dword [esp + 8]
push esi
nop dword [eax]
mov esi, ecx
shr ecx, 1
and esi, 1
neg esi
shr esi, 4
movzx edx, word [eax + ecx*2]
and esi, 0x7f
shr edx, 4
xor edx, esi
movzx edx, byte [edx + 0x76d368]
add edi, edx
cmp ecx, 1
jne 0x6d6df0
pop esi
mov eax, edi
pop edi
ret

Function at 0x6d8120
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6d814d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6d814d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x43eb65ba
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x67795127
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x406b60
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x415a8e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0040d1c0
xor edi, edi
mov eax, 0x418a80
mov dword [esp + 0x1c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x6c]
mov byte [esp + 0x1c], 3
call fcn.004143d2
lea ecx, [esi + 0x70]
mov byte [esp + 0x1c], 4
call fcn.004143d2
lea ecx, [esi + 0x74]
mov byte [esp + 0x1c], 5
call fcn.004143d2
lea ebp, [esi + 0x78]
mov byte [esp + 0x1c], 6
mov ecx, ebp
call fcn.004143d2
lea ebx, [esi + 0x7c]
mov byte [esp + 0x1c], 7
mov ecx, ebx
call fcn.004143d2
lea ecx, [esi + 0x80]
mov byte [esp + 0x1c], 8
call fcn.004143d2
lea edx, [esi + 0x10]
mov eax, 0xa
mov ecx, eax
push str.Arial
mov dword [edx], eax
mov byte [esp + 0x20], 9
mov dword [esi], fcn.0040d310
mov dword [esi + 0x50], edi
mov dword [edx + 4], ecx
xor ecx, ecx
mov dword [esi + 0x5c], 1
mov dword [esi + 0x60], edi
mov dword [edx + 8], eax
mov dword [esi + 0x68], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x90], eax
mov ecx, ebp
mov dword [esi + 0x94], edi
mov dword [esi + 0x64], edi
call fcn.004143cc
push str.Times_New_Roman
mov ecx, ebx
call fcn.004143cc
push str.Arial
lea ecx, [esi + 0x80]
call fcn.004143cc
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x84], 0xc
mov dword [esi + 0x88], 6
mov dword [esi + 0x8c], 0xa
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x406cd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x415b26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], fcn.0040d310
mov eax, dword [esi + 0x60]
mov dword [esp + 0x18], 9
test eax, eax
je 0x406d5c
mov eax, dword [esi + 0x50]
test eax, eax
je 0x406d15
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esi + 0x54]
test eax, eax
je 0x406d25
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esi + 0x58]
test eax, eax
je 0x406d5c
mov eax, dword [esi + 0x60]
xor edi, edi
test eax, eax
jle 0x406d50
mov eax, dword [esi + 0x58]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x406d48
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esi + 0x60]
inc edi
cmp edi, eax
jl 0x406d35
mov eax, dword [esi + 0x58]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esi + 0x80]
mov byte [esp + 0x18], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x7c]
mov byte [esp + 0x18], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x74]
mov byte [esp + 0x18], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x6c]
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CString::CString
lea edi, [esi + 0x30]
mov dword [esp + 0xc], edi
mov dword [edi], 0x418a3c
mov ecx, edi
mov byte [esp + 0x18], 0xa
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [edi], 0x418a50
lea edi, [esi + 0x28]
mov dword [esp + 0xc], edi
mov dword [edi], 0x418a3c
mov ecx, edi
mov byte [esp + 0x18], 0xb
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [edi], 0x418a50
lea edi, [esi + 0x20]
mov dword [esp + 0xc], edi
mov dword [edi], 0x418a3c
mov ecx, edi
mov byte [esp + 0x18], 0xc
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x418a50
mov dword [esp + 0x18], 0xffffffff
call fcn.0040d240
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x408ed0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
mov si, ax
or dl, 0xff
or cl, 0xff
add eax, 0xffff
test si, si
je 0x408f15
mov esi, dword [esp + 8]
and eax, 0xffff
inc eax
push edi
mov edi, eax
mov al, byte [esi]
xor al, cl
inc esi
movzx ax, al
and eax, 0xffff
mov cl, byte [eax + 0x418ab0]
xor cl, dl
mov dl, byte [eax + 0x418bb0]
dec edi
jne 0x408ef5
pop edi
mov byte [0x41d742], cl
mov byte [0x41d741], dl
mov ax, 1
pop esi
ret 8
Function at 0x40e2d0
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [ecx + 4]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, 1
ret

Function at 0x40e430
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [esp + 0x18]
push edi
xor ebx, ebx
lea edi, [esi + 8]
mov dword [esp + 0x10], ebx
push edi
mov dword [esp + 0x18], ebx
call ebp
mov edx, dword [esi + 0x28]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x24], ebx
je 0x40e526
push edi
call ebp
mov edx, dword [esi + 0x28]
lea ebx, [esi + 0x3c]
lea eax, [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x24]
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40e4d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
mov dword [esp + 0x10], eax
je 0x40e4af
push str.ReadFile__
jmp 0x40e4ca
mov ecx, dword [esi + 0x28]
lea eax, [esp + 0x14]
push 1
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40e4d1
push str.GetOverlappedResults___in_ReadFile__
mov ecx, esi
call fcn.0040e2f0
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + 0x84]
mov ecx, dword [esi + 0x80]
and eax, 0xff
push edx
push eax
mov edx, dword [ecx + 0x20]
push 0x407
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push edi
call ebp
mov edx, dword [esi + 0x28]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push edi
call ebx
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x40e476
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x40fb26
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
xor ebx, ebx
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0040fbf2
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x78
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 8], 0x41
mov byte [ebp - 0x11], 0x56
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 7], bl
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x6e
mov dword [ebp - 0xa8], 0x94
call fcn.0040fc21
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0xa8]
push ecx
call eax
test eax, eax
push 0x14
lea eax, [ebp - 0x14]
push ebx
push eax
jne 0x40fbb2
call fcn.0040fbf2
add esp, 0xc
xor eax, eax
jmp 0x40fbef
call fcn.0040fbf2
mov eax, dword [ebp - 0x98]
add esp, 0xc
sub eax, ebx
je 0x40fbec
dec eax
je 0x40fbcc
dec eax
je 0x40fbde
jmp 0x40fbae
cmp dword [ebp - 0xa0], ebx
jne 0x40fbd8
push 4
jmp 0x40fbee
jbe 0x40fbde
push 5
jmp 0x40fbee
cmp dword [ebp - 0xa4], 5
sbb eax, eax
add eax, 7
jmp 0x40fbef
push 3
pop eax
pop ebx
leave
ret
Function at 0x40fc21
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0040fbf2
mov eax, dword [0x41ecec]
and byte [ebp - 8], 0
add esp, 0xc
cmp eax, 1
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0x14], 0x6b
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
jne 0x40fc84
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x41ecec], eax
leave
ret
Function at 0x4108af
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x14
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0040fbf2
and byte [ebp - 0x17], 0
add esp, 0xc
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x53
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x54
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x18], 0x65
call fcn.0040fc21
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410917
lea ecx, [ebp - 0x10]
push ecx
call eax
push esi
push 0x14
movzx esi, word [ebp - 0x10]
movzx eax, word [ebp - 0xe]
imul esi, esi, 0xd
add esi, eax
push 0
movzx eax, word [ebp - 0xa]
imul esi, esi, 0x1e
add esi, eax
movzx eax, word [ebp - 8]
imul esi, esi, 0x1a
imul eax, eax, 0x3d
add esi, eax
movzx eax, word [ebp - 6]
add esi, eax
movzx eax, word [ebp - 4]
imul esi, esi, 0x3c
add esi, eax
movzx eax, word [ebp - 2]
imul esi, esi, 0x4d2
add esi, eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040fbf2
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x41096a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
xor ebx, ebx
push 0x11
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.0040fbf2
add esp, 0xc
mov byte [ebp - 0x20], 0x2a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x1f], 0x89
mov byte [ebp - 0xf], 0x21
mov byte [ebp - 0x1e], 0xed
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0x1d], 0x5e
mov byte [ebp - 0xd], 0xa4
mov byte [ebp - 0x1c], 0x49
mov byte [ebp - 0xc], 0x10
mov byte [ebp - 0x1b], 0x26
mov byte [ebp - 0xb], 0x7e
mov byte [ebp - 0x1a], 0x40
mov byte [ebp - 0xa], 0x51
mov byte [ebp - 0x19], 0x19
mov byte [ebp - 9], 0x25
mov byte [ebp - 0x18], 0x80
mov byte [ebp - 8], 0x25
mov byte [ebp - 0x17], 0x40
mov byte [ebp - 7], bl
mov byte [ebp - 0x16], 0xe2
mov byte [ebp - 6], bl
mov byte [ebp - 0x15], 0x51
mov byte [ebp - 5], 0x2d
mov byte [ebp - 0x14], 0xaa
mov byte [ebp - 4], bl
mov byte [ebp - 0x13], 0xfa
mov byte [ebp - 3], bl
mov byte [ebp - 0x12], 0xdb
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x53
mov byte [ebp - 0x30], 0x79
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6d
mov byte [ebp - 0x2b], 0x54
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], bl
call fcn.0040fc21
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x58]
push ecx
call eax
mov ax, word [ebp - 0x58]
xor ecx, ecx
mov cl, ah
mov byte [ebp - 7], al
mov ax, word [ebp - 0x56]
mov byte [ebp - 6], cl
xor ecx, ecx
mov byte [ebp - 4], al
mov cl, ah
lea eax, [ebp - 0xc8]
push eax
mov byte [ebp - 5], 0x2d
mov byte [ebp - 3], cl
call fcn.00410ae4
lea eax, [ebp - 0x20]
push 0x1e
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00410b0c
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00410baa
add esp, 0x18
xor eax, eax
cmp byte [eax + ebp - 0x48], bl
lea ecx, [eax + ebp - 0x48]
jne 0x410aa6
mov byte [ecx], 1
inc eax
cmp eax, 0x10
jl 0x410a99
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004117f0
movzx ax, byte [ebp + 8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00411596
push dword [ebp + 0xc]
call fcn.004117bd
push 0x1e
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.0040fbf2
add esp, 0x20
xor eax, eax
pop ebx
leave
ret

Function at 0x410ae4
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4115ef
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
push edi
xor ecx, ecx
movzx eax, byte [ecx + str.80_]
mov esi, dword [ebp + 8]
mov edx, eax
sar edx, 3
and eax, 7
mov dl, byte [esi + edx]
test byte [eax*2 + 0x41e404], dl
setne al
mov byte [ecx + ebp - 0x74], al
inc ecx
cmp ecx, 0x38
jl 0x4115fd
and dword [ebp + 8], 0
mov dword [ebp - 4], 0x1e
cmp word [ebp + 0xc], 1
jne 0x41163d
mov eax, dword [ebp - 4]
jmp 0x411642
mov eax, dword [ebp + 8]
add eax, eax
and dword [ebp + eax*4 - 0xf0], 0
and dword [ebp + eax*4 - 0xf4], 0
lea ecx, [ebp + eax*4 - 0xf0]
lea esi, [ebp + eax*4 - 0xf4]
mov eax, dword [ebp + 8]
xor edx, edx
movzx eax, byte [eax + 0x41e4ac]
mov edi, eax
cmp edi, 0x1c
jge 0x411679
mov bl, byte [edi + ebp - 0x74]
jmp 0x411680
mov bl, byte [edi + ebp - 0x90]
mov byte [edx + ebp - 0x3c], bl
inc edx
inc edi
cmp edx, 0x1c
jl 0x41166e
push 0x1c
pop edi
add eax, edi
cmp eax, 0x38
jge 0x41169b
mov dl, byte [eax + ebp - 0x74]
jmp 0x4116a2
mov dl, byte [eax + ebp - 0x90]
mov byte [edi + ebp - 0x3c], dl
inc edi
inc eax
cmp edi, 0x38
jl 0x411690
xor edi, edi
mov edx, 0x41e414
movzx ebx, byte [edi + 0x41e4bc]
lea eax, [edi + 0x41e4d4]
cmp byte [ebx + ebp - 0x3c], 0
je 0x4116cc
mov ebx, dword [edx]
or dword [esi], ebx
movzx eax, byte [eax]
cmp byte [eax + ebp - 0x3c], 0
je 0x4116da
mov eax, dword [edx]
or dword [ecx], eax
add edx, 4
inc edi
cmp edx, str.80_
jl 0x4116b4
sub dword [ebp - 4], 2
inc dword [ebp + 8]
cmp dword [ebp - 4], 0xfffffffe
jg 0x411631
lea eax, [ebp - 0xf4]
push eax
call fcn.00411709
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411961
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push 0x11
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.0040fbf2
lea eax, [ebp - 0xc8]
mov byte [ebp - 0x20], 0x2a
push eax
mov byte [ebp - 0x10], 0x89
mov byte [ebp - 0x1f], 0x2f
mov byte [ebp - 0xf], 0x21
mov byte [ebp - 0x1e], 0xed
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0x1d], 0x5e
mov byte [ebp - 0xd], 0xa4
mov byte [ebp - 0x1c], 0x55
mov byte [ebp - 0xc], 0x10
mov byte [ebp - 0x1b], 0x26
mov byte [ebp - 0xb], 0x7e
mov byte [ebp - 0x1a], 0x40
mov byte [ebp - 0xa], 0x51
mov byte [ebp - 0x19], 0x19
mov byte [ebp - 9], 0x22
mov byte [ebp - 0x18], 0x60
mov byte [ebp - 8], 0x25
mov byte [ebp - 0x17], 0x40
mov byte [ebp - 7], 0x11
mov byte [ebp - 0x16], 0xe2
mov byte [ebp - 6], 0x2b
mov byte [ebp - 0x15], 0x78
mov byte [ebp - 5], 0x3c
mov byte [ebp - 0x14], 0xee
mov byte [ebp - 4], 0x46
mov byte [ebp - 0x13], 0xfa
mov byte [ebp - 3], 0x5e
mov byte [ebp - 0x12], 0xdb
mov byte [ebp - 0x11], 0xcb
call fcn.00410ae4
lea eax, [ebp - 0x20]
push 0x1e
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00410b0c
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00410baa
add esp, 0x24
xor ecx, ecx
cmp byte [ecx + ebp - 0x48], 0
lea eax, [ecx + ebp - 0x48]
jne 0x411a30
mov byte [eax], 1
inc ecx
cmp ecx, 0x10
jl 0x411a22
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004117f0
movzx ax, byte [ebp + 8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00411596
push dword [ebp + 0xc]
call fcn.004117bd
push 0x1e
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.0040fbf2
and byte [ebp - 0x27], 0
add esp, 0x20
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x53
mov byte [ebp - 0x30], 0x79
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6d
mov byte [ebp - 0x2b], 0x54
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x65
call fcn.0040fc21
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x58]
push ecx
call eax
mov cx, word [ebp - 0x58]
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dl, ch
mov byte [eax], cl
mov cx, word [ebp - 0x56]
mov byte [eax + 1], dl
xor edx, edx
mov byte [eax + 2], cl
mov dl, ch
mov byte [eax + 3], dl
leave
ret