joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b4c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
mov edi, edx
mov esi, dword [ebx + 8]
mov eax, dword [ebx]
cmp eax, dword [esi*4 + 0x5c21f8]
jb 0x43b4e8
call fcn.0043b370
test eax, eax
jne 0x43b5f8
movsx ecx, byte [edi]
mov edx, edi
mov esi, 0x1505
test ecx, ecx
je 0x43b509
mov eax, esi
lea edx, [edx + 1]
shl esi, 5
add esi, ecx
movsx ecx, byte [edx]
add esi, eax
test ecx, ecx
jne 0x43b4f6
mov ecx, dword [ebx + 8]
xor edx, edx
mov eax, esi
push esi
push edi
div dword [ecx*4 + 0x5c21f8]
mov eax, dword [ebx + 4]
mov ecx, ebx
lea edx, [eax + edx*8]
mov dword [ebp - 8], edx
call fcn.0043b2a0
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x43b561
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x43b54f
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x43b54f
add eax, 0xffffffff
mov dword [ecx + 4], eax
jne 0x43b54f
call fcn.00439ab0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword [ecx + 0xc], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43b566
sub ecx, edx
add ecx, 0x15
je 0x43b5f8
push ecx
call fcn.0046ecaf
mov edx, eax
add esp, 4
test edx, edx
je 0x43b5f8
mov ecx, dword [ebp + 8]
mov dword [edx + 0x10], ecx
mov ecx, edx
mov dword [edx], esi
sub ecx, edi
mov al, byte [edi]
lea edi, [edi + 1]
mov byte [ecx + edi + 0x13], al
test al, al
jne 0x43b593
mov edi, dword [ebp - 8]
lea ecx, [edx + 4]
mov eax, dword [ebp + 0xc]
lea esi, [ebx + 0xc]
mov dword [edx + 0xc], eax
mov dword [ecx + 4], ecx
mov dword [ecx], ecx
mov edx, dword [edi]
cmp edx, esi
jne 0x43b5dd
cmp edx, dword [edi + 4]
jne 0x43b5dd
mov dword [ecx + 4], esi
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi]
mov dword [eax + 4], ecx
mov dword [esi], ecx
mov dword [edi + 4], ecx
mov dword [edi], ecx
inc dword [ebx]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ecx + 4], edx
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx]
mov dword [eax + 4], ecx
mov dword [edx], ecx
mov dword [edi], ecx
inc dword [ebx]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44ffef
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x47c03c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047bebb

Function at 0x47e55c
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047e461

Function at 0x4835c7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00482f35

Function at 0x4835d2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00483170
Function at 0x4998a0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.0044e530
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x49992d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x49992d
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0040e950
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.0046de4a
add esp, 0x1c
or ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
lea ecx, [ebp - 0x208]
push 0
push ecx
test eax, eax
mov ecx, 0x200
cmovs eax, ecx
push eax
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x499a75
mov ebx, dword [ebp + 8]
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x499935
sub ecx, edx
lea edi, [ecx + 1]
lea eax, [edi + edi]
call fcn.0044dfe0
mov esi, esp
test esi, esi
jne 0x499959
mov esi, str.no_stack_
jmp 0x4999e3
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x499982
xor ecx, ecx
test edi, edi
je 0x499982
mov eax, dword [ebp + 8]
movsx ax, byte [ecx + eax]
mov word [esi + ecx*2], ax
inc ecx
cmp ecx, edi
jb 0x499971
xor ecx, ecx
test edi, edi
je 0x4999e3
lea ebx, [ecx + 0x53]
nop dword [eax + eax]
cmp word [esi + ecx*2], 0x25
jne case.0x4999b2.43
lea edx, [ecx + 1]
lea edx, [esi + edx*2]
nop dword [eax]
movzx eax, word [edx]
add eax, 0xffffffd6
cmp eax, 0x49
ja case.0x4999b2.43
movzx eax, byte [eax + 0x499aa4]
jmp dword [eax*4 + 0x499a8c]
inc ecx
add edx, 2
jmp 0x4999a0
mov word [esi + ecx*2 + 2], bx
jmp case.0x4999b2.43
mov eax, 0x73
jmp 0x4999d9
mov eax, 0x43
jmp 0x4999d9
mov eax, 0x63
mov word [esi + ecx*2 + 2], ax
inc ecx
cmp ecx, edi
jb 0x499990
lea eax, [ebp + 0xc]
push eax
push 0
push esi
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.0040e950
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.0046de92
add esp, 0x1c
xor eax, eax
mov word [ebp - 6], ax
call fcn.00499780
test eax, eax
jle 0x499a5f
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x499a75
push 0
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x208]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x499a75
push 0x10
push str.OpenSSL:_FATAL
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044d318
mov esp, ebp
pop ebp
ret
Function at 0x4b6520
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
xor ecx, ecx
xor dl, dl
test edi, edi
je 0x4b658a
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4b658a
movzx esi, byte [edi]
cmp dword [esp + 0x18], ecx
jne 0x4b654f
cmp esi, 0x7f
jbe 0x4b6585
mov ecx, 1
lea ebp, [ecx + eax]
jmp 0x4b6591
or dl, 0xff
cmp esi, 0x80
jbe 0x4b6564
mov ecx, 1
lea ebp, [ecx + eax]
jmp 0x4b6591
jne 0x4b6585
xor edx, edx
lea esi, [edx + 1]
cmp eax, esi
jbe 0x4b657b
nop
movzx ecx, byte [esi + edi]
inc esi
or edx, ecx
cmp esi, eax
jb 0x4b6570
neg edx
sbb dl, dl
movzx ecx, dl
and ecx, 1
lea ebp, [ecx + eax]
jmp 0x4b6591
mov ebp, 1
xor eax, eax
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x4b65dd
mov esi, dword [esi]
test esi, esi
je 0x4b65dd
mov byte [esi], dl
push ebx
movzx edx, dl
lea ebx, [esi + ecx]
mov dword [esp + 0x14], edx
lea esi, [edi + eax]
and edx, 1
add ebx, eax
test eax, eax
je 0x4b65d6
mov edi, dword [esp + 0x14]
sub ebx, esi
nop
movzx ecx, byte [esi - 1]
lea esi, [esi - 1]
xor ecx, edi
add edx, ecx
mov byte [ebx + esi], dl
shr edx, 8
sub eax, 1
jne 0x4b65c0
mov eax, dword [esp + 0x20]
pop ebx
add dword [eax], ebp
pop edi
pop esi
mov eax, ebp
pop ebp
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x40153f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0x134]
sub esp, 0x154
mov dword [ebp - 0x134], 0
mov dword [esp], eax
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x118], 6
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x120], 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push ecx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
lea ebx, [ebp - 0x10c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push eax
push eax
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp - 4]
leave
sub eax, 3
ret

Function at 0x40162d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.0040153f
test eax, eax
jne 0x4016c7
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x40215e
sub eax, 0x4016fc
mov dword [esp], 0x4016fc
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x4016c7
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401442
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004014c9
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b600
mov dword [esp], 0x40300c
call fcn.00401e61
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x8627a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2e6000]
push edi
or ebp, 0xffffffff
jmp 0x8627c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8627c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8627b8
mov eax, 1
add ebx, ebx
jne 0x8627db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8627ec
jne 0x86280b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x86280b
dec eax
add ebx, ebx
jne 0x8627f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8627d0
add ebx, ebx
jne 0x862807
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x86285d
xor ecx, ecx
sub eax, 3
jb 0x862823
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x862892
sar eax, 1
mov ebp, eax
jmp 0x86282e
add ebx, ebx
jne 0x86282e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8627fc
inc ecx
add ebx, ebx
jne 0x86283c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8627fc
add ebx, ebx
jne 0x862849
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x86283e
jne 0x86285a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x86283e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x86287c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x86286e
jmp 0x8627be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x86287c
add edi, ecx
jmp 0x8627be
pop esi
mov edi, esi
mov ecx, 0x1154b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x86289a
cmp byte [edi], 0x7a
jne 0x86289a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x86289f
lea edi, [esi + 0x45d000]
mov eax, dword [edi]
or eax, eax
je 0x86290e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x46b50c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x46b674]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8628cc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x46b678]
or eax, eax
je 0x862908
mov dword [ebx], eax
add ebx, 4
jmp 0x8628e9
call dword [esi + 0x46b688]
mov ebp, dword [esi + 0x46b67c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x862942
sub esp, 0xffffff80
jmp 0x666f14
Function at 0x401ff0
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0
push eax
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x411d78
push 0x411cb0
push 0
mov dword [0x411e40], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
jne 0x40202a
pop esi
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0xea60
push 0x3e9
push esi
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
pop esi
ret

Function at 0x4021fc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410040]
jne 0x402206
repz ret
jmp fcn.004029f8

Function at 0x409819
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x409854
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40983b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40984c
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x409856
inc edi
add eax, 0x28
cmp edi, esi
jb 0x409831
xor eax, eax
pop edi
pop esi
ret
Function at 0x409e79
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x409e8d
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x409e88
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x409e72
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x409e7a
cmp edx, ebx
jne 0x409fc8
invalid
add byte [ebx + 0x45830448], cl
or byte [edx], al
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x409e49
add eax, dword [eax + 4]
jmp 0x409e36
mov dword [ebp + 0xc], ebx
jmp 0x409e98
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x409eb0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x409ece
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
xchg esp, eax
invalid
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x409f2c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x409f13
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x409f1c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x409f26
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x409f08
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x409e92
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
add bl, byte [ecx + 0xf]
mov dh, 4
pop es
sub eax, ecx
je 0x409f79
dec eax
je 0x409f70
sub eax, 3
je 0x409f67
mov dword [ebp - 4], 0x40
jmp 0x409f96
mov dword [ebp - 4], 4
jmp 0x409f7c
mov dword [ebp - 4], 0x20
jmp 0x409f7c
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x409fc8
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x409f48
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004097d9
add dword [esi + 0x75ff811d], 0x14
push 1
push esi
call edi
mov eax, esi
jmp 0x409fd4
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a006
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.004097e9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040979e
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
jmp [ebx]
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
or al, dh
test dword [esp + edi*8 - 1], ecx
inc dword [ebx]
Function at 0x40a2f2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stc
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.004097e9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040979e
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.004097d9
cmp eax, edx
dec ebx
inc esi
and byte [ebp - 0x664], 0
and byte [ebp - 0x663], 0
inc dword [eax]
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
inc dword [eax]
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.004097e9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040979e
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.004097e9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040979e
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.004097d9
lds esp, [esi]
popfd
sbb al, byte [eax - 0x5135b]
inc dword [eax]
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.004097e9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040979e
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.004097d9
cmp bl, byte [eax]
jle 0x40a4ef
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
push 0xfffffc
stc
invalid

Function at 0x40a4cd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp + 0xc], 8
jne 0x40a65f
invalid
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
Function at 0x40a75f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x11fffffc]
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.004097e9
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040979e
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.004097d9
sub dword [ebx + 0x468b37e], ebp
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid