joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1025a4b0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1025a54d
push ebx
push esi
call fcn.1025a59e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1025a3b4
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1025a4fa
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1025a54c
push edi
push eax
call fcn.10255358
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1025a51a
call fcn.10252d95
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1025a54b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1025a3b4
add esp, 0x20
test eax, eax
jne 0x1025a539
push edi
call fcn.10252d95
jmp 0x1025a541
push ebx
call fcn.10252d95
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1025a550
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1025a561
pop esi
ret
push ebx
push edi
push esi
call fcn.1025a59e
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10255358
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1025a589
push ebx
push esi
push edi
call fcn.1023a630
add esp, 0xc
push 0
call fcn.10252d95
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1025a5e0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1025a84b
Function at 0x10264144
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.102642db
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x102642b3
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x102642b3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10264268
jg 0x102641a0
test eax, eax
je 0x1026425e
push 1
push 0x1000
call fcn.10252d38
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x102641c3
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10264255
push 0x8000
push ebx
call fcn.1026403e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x102641ec
jg 0x102641e7
cmp ecx, 0x1000
jb 0x102641ec
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1024c344
add esp, 0x10
cmp eax, 0xffffffff
je 0x10264231
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x102641e7
jl 0x10264218
test ecx, ecx
jne 0x102641d9
push dword [ebp - 0xc]
push ebx
call fcn.1026403e
push esi
call fcn.10252d95
add esp, 0xc
xor ebx, ebx
jmp 0x102642c1
cmp byte [edi + 0x24], 0
je 0x10264248
cmp dword [edi + 0x20], 5
jne 0x10264248
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10264253
mov ebx, dword [edi + 0x18]
jmp 0x10264255
xor ebx, ebx
push esi
call fcn.10252d95
pop ecx
jmp 0x102642c1
test ecx, ecx
jg 0x1026422a
jl 0x10264268
test eax, eax
jae 0x1026422a
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10259810
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10264288
cmp byte [edi + 0x1c], 0
je 0x1026422a
jmp 0x102642b9
push ebx
call fcn.1025b635
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1026422a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x102642c1
cmp byte [edi + 0x1c], 0
je 0x102642be
mov ebx, dword [edi + 0x18]
jmp 0x102642c1
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10259810
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43e9c2
Capabilities:
Encode data using xor

Disassembly:
cli
mov byte [eax], bh
mov byte [0x16779a4a], al
dec edx
lcall 0x56bc, 0x95281677
add eax, esp
dec edx
lcall 0x56bc, 0x95281677
add eax, esp
pop eax
sub al, 0x64
xor al, cl
xor al, cl
pop esp
nop
insd dword es:[edi], dx
jge 0x43e9be
jb 0x43e9ce
push 0x1b
xchg dword [eax - 0x1b], esp
and al, 0xbf
invalid

Function at 0x43eb59
Capabilities:
Encode data using xor

Disassembly:
wait
and byte [ecx + 0x5f], ch
cmp byte [eax], al
test dword [ebx + 0x6b27b9c8], 0x7954f74b
inc ebp
dec ebx
not dword [ecx + edi*2 + 0x45]
xchg edi, eax
dec dword [esp + esi*2]
lodsd eax, dword [esi]
xor eax, 0x7204a16f
push esi
push 0xffffffffffffffb0
salc
ficomp word [ebp + 0x7ddd020c]
or al, 2
fnstsw word [ebp - 0x46]
push edx
mov al, byte [0x95a3f67]
jge 0x43ebb0
or al, 2
fnstsw word [ebp - 0x46]
push edx
mov al, byte [0x95a3f67]
jge 0x43ebb0
jbe 0x43eb36
push ss
sbb dword [ebx], esp
loopne 0x43eb42
invalid
xchg esp, eax
in al, 0xe7
insd dword es:[edi], dx
mov eax, 0x8482b3b8
cwde
xchg esi, eax
cwde
invalid

Function at 0x53ca4f
Capabilities:
Encode data using xor

Disassembly:
push 0xe7a3dab6
stc
add al, 0x81
inc edi
mov byte [0xef49554f], al
and eax, 0x662325c1
xchg cx, ax
sub byte [ebp - 0x78df7eb9], ch
cwde
out 0xad, al
push edi
inc eax
inc ebx
sbb edx, dword [esi + 0x282734fd]
les esp, [esi + 0x2dd4a708]
not dword [ecx + 0x702f6700]
fucomi st(4)
mov cl, 0x42
pop ds
sub esi, dword [esi + ebp + 0x36]
scasb al, byte es:[edi]
push esp
xchg edi, eax
imul dword [esi]
invalid

Function at 0x56a039
Capabilities:
Encode data using xor

Disassembly:
fisttp dword [ecx]
dec edx
mov bh, 0x9b
add dword [edx + 0x65276b6e], edi
add byte [edi - 0x5e306c17], al
push 0x466f6a05
xor bh, cl
out 0x42, al
pop ss
test eax, eax
not dword [edi + 0x791c23d]
mov ss, word [0x4516a508]
cmp cl, byte [edx]
adc dword [esi - 0x34], edx
fsubr st(4), st(0)
mov dword [0x84cccf7c], eax
aaa
lodsb al, byte [esi]
cdq
mov edx, 0xd940ea6f
jb 0x56a053
mov eax, 0xce00f515
add al, 0xf3
mov edx, 0x51c8dc53
pop es
or edi, esp
mov edi, 0x18f04084
pop es
arpl bx, di
mov ebx, 0xce7c6b7b
xchg edi, eax
enter 0xffffffffffffe7d0, 0x4d
or byte [edx - 0x2bda38a0], bh
loopne 0x56a0c8
test al, 0xa3
mov byte [0xdc793abd], al
movsb byte es:[edi], byte [esi]
sal ebp, cl
inc esp
push esi
push esi
pop ss
xor ax, 0xd677
sbb byte [esi - 0x57971d3d], al
mov dword [esi + 0x53], ebp
out 0xdf, al
outsb dx, byte [esi]
insd dword es:[edi], dx
pop es
inc edx
inc eax
mov byte [esi], al
sbb ah, byte [edi + 0x26]
xchg ebp, eax
xchg ebp, eax
push es
mov ebx, 0xf7108443
out 0x4d, eax
xchg dh, cl
test dword [edi], eax
inc esi
mov al, 0x68
dec edi
pop ebp
and edi, eax
cld
dec edi
fidiv word [eax - 0x7b]
neg dword [edi + edx*2]
and dh, byte [esi*2 - 0xa34feaa]
add ebx, ecx
cmc
fldenv [esi + 0x7aa28ec7]
stosb byte es:[edi], al
pop ds
jecxz 0x56a134
adc al, 0x63
in al, dx
xor eax, 0x6957a797
push edi
jl 0x56a0ed
xor eax, 0x36588e60
push esi
into
pop edx
xchg dword [0xa1f7ea27], edi
into
iretd
cmp al, 0xde
invalid
Function at 0x5cdc2f
Capabilities:
Encode data using xor

Disassembly:
rol dword [eax], cl
mov edx, 0x13022230
cwde
bound ebp, qword [edx - 0x6d]
mov edi, 0x4d9c6c3b
and ah, byte [ebx - 0x26]
invalid

Function at 0x6005f7
Capabilities:
Encode data using xor

Disassembly:
invalid
jl 0x60058a
inc esi
fmul dword [esi]
and dh, byte [eax - 0x78]
lea esp, [ebp + eax*4 + 0x4d]
inc edi
stosd dword es:[edi], eax
jl 0x600642
movsb byte es:[edi], byte [esi]
add ah, byte [edx - 0x4fa653d0]
dec eax
mov ebp, edx
xor byte [eax - 6], bl
test eax, 0xadeabc78
xchg ebx, eax
push 0xd9ccf600
and al, byte [edx + edx*8 + 0x1ca6fce3]
jecxz 0x600620
cmpsb byte [esi], byte es:[edi]
sbb al, 0x98
mov bl, 0xc9
jns 0x600687
jge 0x600668
sbb eax, 0xc7697c72
mov dword [0xc3d44cf9], eax
sbb edx, dword [eax + 0x40]
jae 0x60068f
add eax, 0xc37f20cb
and byte [edi - 0x3d], bh
in al, dx
mov ebx, 0x58051f47
salc
pop esi
int1
shr dword [eax], 1
jmp 0x2b36402b
mov edi, 0xb92ad639
mov byte [0x79078cf2], al
sbb al, 0x18
inc eax
fiadd word [esi - 0x7c]
dec edx
pop ss
aam 0x11
je 0x600659
mov edx, 0xe7823509
out dx, eax
salc
salc
jl 0x600625
popfd
cdq
xor al, byte [ebx + edx*2 - 0x43dc3a58]
sub al, 0xf
sbb ah, byte [ecx + 0x47]
mov esp, 0x611a0f2c
inc edi
push es
je 0x600687
lcall 0x9859, 0xc9946aef
pop ebx
cwde
retf

Function at 0x6599ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x662398
cmp edx, dword [eax]
je 0x6599cf
add eax, 8
inc ecx
cmp eax, 0x662428
jl 0x6599c0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x662398]
jne 0x659afd
mov eax, dword [0xa5f0fc]
cmp eax, 1
je 0x659ad7
test eax, eax
jne 0x659a00
cmp dword [0x6622c4], 1
je 0x659ad7
cmp edx, 0xfc
je 0x659afd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 8]
lea esi, [esi + 0x66239c]
push 0
push eax
push dword [esi]
call fcn.0065a820
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x1b9a39ee
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6cee5b1e
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40aa5b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x41a004]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
mov esi, dword [ebp + 8]
push 0x4074dc
push 0x4074f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40aa95
push 0x800
call eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xc]
call fcn.00409cb0
push esi
lea ecx, [esp + 0x24]
call fcn.0040921b
lea ecx, [esp + 0x20]
call fcn.004095c7
mov esi, eax
test esi, esi
jns 0x40aae9
lea ecx, [esp + 8]
call fcn.0040a9d0
test al, al
je 0x40ab33
cmp esi, 0x80040b00
jne 0x40ab33
lea ecx, [esp + 0x20]
call fcn.00409683
mov esi, eax
test esi, esi
js 0x40ab33
mov esi, 0x80040b02
jmp 0x40ab33
cmp dword [esp + 0x1c], 8
lea esi, [esp + 8]
jb 0x40aaf8
mov esi, dword [esp + 8]
push 0x406f80
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40ab2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x40ab24
jle 0x40ab33
movzx esi, si
or esi, 0x80070000
jmp 0x40ab33
mov esi, 0x80004005
jmp 0x40ab33
push dword [ebp + 0x14]
push esi
call eax
mov esi, eax
lea ecx, [esp + 0x20]
call fcn.004092b7
lea ecx, [esp + 8]
call fcn.00409da9
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040b187
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41051a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004101aa
push eax
push esi
push dword [ebp + 8]
call fcn.0041015f
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
xchg edi, eax

Function at 0x4105a9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x4105b3
call fcn.0041015f
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004101aa
push eax
push esi
push dword [ebp + 8]
call fcn.0041015f
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0041019a
cmp byte [esi], bl
dec edx
sbb eax, 0xff7c9d88
invalid
invalid
Function at 0x410873
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x410871
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x41088f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
add byte [eax], al
add byte [ebx + 0x448d2478], cl
or bh, bh
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4108ed
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4108d4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4108dd
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4108e7
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4108c9
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x410853
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x41093a
dec eax
je 0x410931
sub eax, 3
je 0x410928
mov dword [ebp - 4], 0x40
jmp 0x410957
mov dword [ebp - 4], 4
jmp 0x41093d
mov dword [ebp - 4], 0x20
jmp 0x41093d
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x410989
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
push dword [esi - 0x60]
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0041019a
loop 0x41098b
sti
mov ecx, 0x6a1475ff
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x410995
push 0x8000
add byte [eax], 0
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x410e84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp + 0xc], 1
je 0x411058
cmp dword [ebp + 0xc], 8
jne 0x411020
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
call fcn.0041019a
add byte [ebx], ch
push cs
mov dl, 0x80
movsd dword es:[edi], dword [esi]
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.0041019a
mov ebx, 0x80c82a5c
movsd dword es:[edi], dword [esi]
sar ch, 1
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
Function at 0x411098
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00410178
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
invalid

Function at 0x41144e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x334]
push eax
call dword [ebp - 0x3c8]
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0xffffffff
je 0x41232d
push 0
push dword [ebp - 0x66c]
call dword [ebp - 0x33c]
mov dword [ebp - 0x378], eax
push dword [ebp - 0x378]
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 4], eax
call fcn.0041019a
out 0xea, eax
in eax, dx
and byte cs:[ebp - 0x6dc], 0
and byte [ebp - 0x6db], 0
mov byte [ebp - 0x6da], 0x2c
and byte [ebp - 0x6d9], 0
mov byte [ebp - 0x6d8], 0x81
mov byte [ebp - 0x6d7], 0xb6
mov byte [ebp - 0x6d6], 0xb2
mov byte [ebp - 0x6d5], 0xb7
mov byte [ebp - 0x6d4], 0x95
mov byte [ebp - 0x6d3], 0xba
mov byte [ebp - 0x6d2], 0xbf
mov byte [ebp - 0x6d1], 0xb6
mov byte [ebp - 0x6d0], 0xd3
invalid
Function at 0x10001190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100011e9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100011e9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x100011d8
cmp esi, edx
jae 0x100011e9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x100011c6
cmp esi, edx
jae 0x100011e9
cmp word [esi], 0
je 0x100011e9
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x10001550
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001516b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x1001e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], esi
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100015c5
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.100031e0
push str.MicrosoftInternet_ExplorerQuick_Launch
lea edx, [ebp - 0x234]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.100037b0
mov edx, dword [ebp - 0x220]
add esp, 4
cmp edx, 8
jb 0x1000163f
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001635
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000165b
push edx
push ecx
call fcn.1000426f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10003c5b
mov esp, ebp
pop ebp
ret
call fcn.10007f66
int3
Function at 0x10001670
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100151ab
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1001e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x21c], edi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], edi
push 0
push eax
call fcn.10005880
mov eax, dword [esi]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x100016d7
push dword [eax - 0xc]
mov ecx, esi
call fcn.10003330
mov eax, dword [esi]
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [esi]
test eax, eax
jne 0x100016f4
xor ecx, ecx
jmp 0x1000170a
push dword [eax - 8]
push eax
call fcn.10007736
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x1000179b
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x1000179b
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
call fcn.10001330
mov ecx, eax
test ecx, ecx
je 0x100017a5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x10001756
movzx eax, ax
mov ecx, edi
push eax
call fcn.100033b0
jmp 0x1000177e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001760
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.10003630
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10003c5b
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.10001140
push 0x80004005
call fcn.10001140
int3