joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ef90
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.004033dc
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x1000dd90
Capabilities:
Encode data using xor
Hash data with crc32
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10035040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], ecx
mov eax, edx
mov dword [ebp - 0x4c], eax
push ebx
push esi
push edi
test ecx, ecx
je 0x1000de1f
test eax, eax
je 0x1000de1f
mov eax, dword [ecx + 0x3c]
xor edi, edi
add eax, ecx
mov dword [ebp - 0x58], eax
mov eax, dword [eax + 0x78]
add eax, ecx
mov dword [ebp - 0x54], eax
mov esi, dword [eax + 0x20]
mov ebx, dword [eax + 0x24]
add esi, ecx
mov eax, dword [eax + 0x18]
add ebx, ecx
mov dword [ebp - 0x50], eax
test eax, eax
je 0x1000de1f
nop dword [eax]
mov edx, dword [esi]
or eax, 0xffffffff
add edx, ecx
mov cl, byte [edx]
test cl, cl
je 0x1000de0b
nop dword [eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100300e8]
mov cl, byte [edx]
test cl, cl
jne 0x1000ddf0
cmp eax, dword [ebp - 0x4c]
je 0x1000de32
mov ecx, dword [ebp - 0x48]
inc edi
add esi, 4
add ebx, 2
cmp edi, dword [ebp - 0x50]
jb 0x1000dde0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c433
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x54]
movzx ecx, word [ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x48]
mov esi, dword [eax + ecx]
add esi, ecx
cmp esi, edx
jbe 0x1000deef
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x7c]
add eax, edx
cmp esi, eax
jae 0x1000deef
mov dl, byte [esi]
xor ecx, ecx
cmp dl, 0x2e
je 0x1000de7e
lea edi, [ebp - 0x44]
mov eax, esi
sub edi, esi
nop
mov byte [eax + edi], dl
lea eax, [eax + 1]
mov dl, byte [eax]
inc ecx
cmp dl, 0x2e
jne 0x1000de70
inc esi
mov dword [ebp + ecx - 0x44], 0x6c6c642e
add esi, ecx
add ecx, 4
cmp ecx, 0x40
jae 0x1000df02
cmp byte [esi], 0x23
mov byte [ebp + ecx - 0x44], 0
mov dword [ebp - 0x48], 0
jne 0x1000decc
mov dl, byte [esi + 1]
inc esi
test dl, dl
je 0x1000dec9
xor eax, eax
nop dword [eax]
lea ecx, [eax + eax*4]
movsx eax, dl
mov dl, byte [esi + 1]
lea esi, [esi + 1]
lea eax, [eax + ecx*2]
add eax, 0xffffffd0
test dl, dl
jne 0x1000deb0
mov dword [ebp - 0x48], eax
lea esi, [ebp - 0x48]
lea eax, [ebp - 0x44]
push eax
call dword [0x10036bc0]
push esi
push eax
call dword [0x10036bc4]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c433
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001c433
mov esp, ebp
pop ebp
ret
call fcn.1001c8e8
int3
Function at 0x10010bd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1398
call fcn.1001d3e0
mov eax, dword [0x10035040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, edx
call fcn.1001c167
mov dword [ebp - 0xc], 0xffffffff
mov esi, 1
mov dword [ebp - 0x138c], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, esi
mov dword [ebp + esi*4 - 0x138c], eax
inc esi
cmp esi, 0x270
jb 0x10010c02
mov eax, edi
mov dword [ebp - 0x1390], 0x270
lea ecx, [ebp - 0x1390]
cdq
mov dword [ebp - 0x1394], ecx
mov ecx, eax
and ecx, edx
cmp ecx, 0xffffffff
jne 0x10010c73
lea ecx, [ebp - 0x1390]
call fcn.100177a0
lea ecx, [ebp - 0x1390]
call fcn.100177a0
mov dword [ebp - 0x1394], 0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c433
mov esp, ebp
pop ebp
ret
add eax, 1
lea ecx, [ebp - 0x1394]
adc edx, 0
push edx
push eax
call fcn.10017920
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001c433
mov esp, ebp
pop ebp
ret
Function at 0x10017180
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x100171a0
pop edi
pop esi
mov dword [ecx], 0x270
mov eax, ecx
pop ebp
ret 4

Function at 0x100177a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x100177fd
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x100177c0
mov eax, dword [esi]
jmp 0x100178db
cmp eax, 0x4e0
jb 0x100178db
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10017816
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10017861
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10017bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x10035040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor edi, edi
cmp dword [0x10035a80], edi
jbe 0x10017d12
push esi
mov esi, 0x100366d0
nop word [eax + eax]
mov ecx, dword [0x10035a84]
mov eax, 0x10035a70
mov edx, dword [0x10035a70]
cmp ecx, 0xf
cmova eax, edx
cmp byte [eax + edi], 0x2b
je 0x10017cb8
cmp ecx, 0xf
mov eax, 0x10035a70
cmova eax, edx
cmp byte [eax + edi], 0x2d
je 0x10017cb8
cmp ecx, 0xf
mov eax, 0x10035a70
cmova eax, edx
cmp byte [eax + edi], 0x2a
je 0x10017cb8
cmp ecx, 0xf
mov eax, 0x10035a70
cmova eax, edx
cmp byte [eax + edi], 0x2f
je 0x10017cb8
mov ebx, dword [esi + 0x14]
cmp ecx, 0xf
mov ecx, dword [esi + 0x10]
mov eax, 0x10035a70
cmova eax, edx
mov dl, byte [eax + edi]
mov byte [ebp - 0x44], dl
cmp ecx, ebx
jae 0x10017ca4
lea eax, [ecx + 1]
mov dword [esi + 0x10], eax
mov eax, esi
cmp ebx, 0xf
jbe 0x10017c9a
mov eax, dword [esi]
mov byte [eax + ecx], dl
mov byte [eax + ecx + 1], 0
jmp 0x10017d04
push dword [ebp - 0x44]
mov byte [ebp - 0x48], 0
push dword [ebp - 0x48]
push ecx
mov ecx, esi
call fcn.1000e5e0
jmp 0x10017d04
mov ebx, dword [esi + 0x2c]
cmp ecx, 0xf
mov ecx, dword [esi + 0x28]
mov eax, 0x10035a70
cmova eax, edx
mov dl, byte [eax + edi]
mov byte [ebp - 0x14], dl
cmp ecx, ebx
jae 0x10017cee
lea eax, [ecx + 1]
mov dword [esi + 0x28], eax
lea eax, [esi + 0x18]
cmp ebx, 0xf
jbe 0x10017ce4
mov eax, dword [esi + 0x18]
mov byte [eax + ecx], dl
mov byte [eax + ecx + 1], 0
jmp 0x10017d01
push dword [ebp - 0x14]
mov byte [ebp - 0xb], 0
push dword [ebp - 0xb]
push ecx
lea ecx, [esi + 0x18]
call fcn.1000e5e0
add esi, 0x30
inc edi
cmp edi, dword [0x10035a80]
jb 0x10017c20
pop esi
movaps xmm0, xmmword [str.dK_aD]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x20], 0x30d4944
movaps xmm0, xmmword [0x10031f30]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0x1160b0a
mov word [ebp - 0x18], 0x44
nop
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x28
jb 0x10017d40
mov al, 0x2c
mov byte [ebp - 0x17], 0
mov byte [ebp - 0xc], al
mov cl, 0x6f
movsx eax, al
mov dl, 0x79
mov byte [ebp - 8], 0
mov bl, 0x70
and eax, 0x8000000f
jns 0x10017d6f
dec eax
or eax, 0xfffffff0
inc eax
sub cl, al
mov byte [ebp - 0xf], 0
sub dl, al
mov byte [ebp - 0xb], cl
sub bl, al
mov byte [ebp - 0xa], dl
mov ah, 0x3c
mov byte [ebp - 9], bl
mov al, 0x53
mov byte [ebp - 0x14], ah
xor al, ah
mov byte [ebp - 8], 0
push 0
mov cl, 0x4c
mov byte [ebp - 0x13], al
xor cl, ah
mov byte [ebp - 0xf], 0
mov dl, 0x59
mov byte [ebp - 0x12], cl
xor dl, ah
mov bl, 0x52
xor bl, ah
mov byte [ebp - 0x11], dl
push 0
lea eax, [ebp - 0x3f]
mov byte [ebp - 0x10], bl
push eax
lea eax, [ebp - 0xb]
mov edx, 0x1483eb77
push eax
lea eax, [ebp - 0x13]
mov ecx, 1
push eax
push 0
call fcn.1000df10
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1001c433
mov esp, ebp
pop ebp
ret
Function at 0x10017de0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x10035040]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
push 0x80000001
mov dword [esp + 0x24], ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x10017f92
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10017e56
cmp eax, 2
je 0x10017f92
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.1001c433
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [edi + eax - 1], 0x5c
lea ebx, [edi + eax]
mov dword [esp + 0x18], ebx
je 0x10017e76
mov byte [ebx], 0x5c
inc ebx
mov dword [esp + 0x18], ebx
mov byte [ebx], 0
lea eax, [esp + 0x20]
mov dword [esp + 0x10], 0x104
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10017f5c
nop word [eax + eax]
mov byte [ebx], 0
mov ecx, 0x208
mov eax, edi
nop word [eax + eax]
cmp byte [eax], 0
je 0x10017ecb
inc eax
sub ecx, 1
jne 0x10017ec0
mov eax, 0x208
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x10017f18
mov edx, 0x208
lea ecx, [esi + edi]
sub edx, esi
je 0x10017f0d
lea esi, [esp + 0x28]
mov eax, 0x7ffffffe
sub esi, ecx
test eax, eax
je 0x10017f09
mov bl, byte [esi + ecx]
test bl, bl
je 0x10017f09
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x10017ef5
mov ebx, dword [esp + 0x18]
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
mov ecx, dword [esp + 0x1c]
push edi
push 0x80000001
call fcn.10017de0
test eax, eax
je 0x10017f5c
lea eax, [esp + 0x20]
mov dword [esp + 0x10], 0x104
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10017eb0
mov byte [ebx - 1], 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.1001c433
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x134]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001c433
mov esp, ebp
pop ebp
ret 8
Function at 0x10017fb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x10035040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10032290]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x21c], 0x76705f76
movups xmmword [ebp - 0x22c], xmm0
mov dword [ebp - 0x218], 0x77687630
xor ecx, ecx
mov dword [ebp - 0x214], 0x6a716c77
mov word [ebp - 0x210], 0x76
nop
movsx eax, byte [ebp - 0x22c]
and eax, 0x8000000f
jns 0x10018013
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x22b], al
inc ecx
cmp ecx, 0x1c
jb 0x10018000
lea edx, [ebp - 0x20c]
mov byte [ebp - 0x20f], 0
lea ecx, [ebp - 0x22b]
mov eax, edx
mov esi, 0x208
sub ecx, eax
nop dword [eax]
lea eax, [esi + 0x7ffffdf6]
test eax, eax
je 0x10018059
mov al, byte [ecx + edx]
test al, al
je 0x10018059
mov byte [edx], al
inc edx
sub esi, 1
jne 0x10018040
lea eax, [edx - 1]
test esi, esi
cmovne eax, edx
mov byte [eax], 0
lea eax, [ebp - 0x20c]
push eax
push ecx
mov ecx, edi
call fcn.10017de0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001c433
mov esp, ebp
pop ebp
ret
Function at 0x1002125e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1002129d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002129d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002129d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1002129d
cmp dword [ecx + 0x74], 0xe
jbe 0x1002129d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100246b6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10024753
push ebx
push esi
call fcn.1002467f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10022ea9
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10024700
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10024752
push edi
push eax
call fcn.10022ad0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10024720
call fcn.10021fd0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10024751
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10022ea9
add esp, 0x20
test eax, eax
jne 0x1002473f
push edi
call fcn.10021fd0
jmp 0x10024747
push ebx
call fcn.10021fd0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1002a560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002a58d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002a58d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x42364c], 0
push esi
push edi
mov esi, edx
jne 0x401146
call section..text
or eax, 0xffffffff
mov edi, 0x80
add esi, 2
movzx edx, byte [esi - 2]
lea esi, [esi + 4]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x423648]
movzx edx, byte [esi - 5]
movzx ecx, al
xor edx, ecx
shr eax, 8
movzx ecx, byte [esi - 4]
xor eax, dword [edx*4 + 0x423648]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x423648]
movzx edx, byte [esi - 3]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x423648]
sub edi, 1
jne 0x401151
pop edi
not eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401660
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x422004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x22c], edx
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4016bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_this_file__error:_u_n
call fcn.00401370
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403088
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4016e0
push str.Failed_to_get_vlnk_file_size_n
call fcn.00401370
add esp, 4
jmp 0x4017bf
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, 0x8000
jne 0x4017b0
test eax, eax
jne 0x4017b0
push 0x200
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.00403ee0
add esp, 0xc
lea eax, [ebp - 0x24]
push 0
push eax
push 0x200
lea eax, [ebp - 0x228]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4017bf
mov dword [ebp - 0x14], 0x77772020
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x10], 0x65762e77
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc], 0x796f746e
mov esi, 0xc
mov dword [ebp - 8], 0x74656e2e
nop word [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4017bf
add ecx, 4
add edx, 4
sub esi, 4
jae 0x401760
mov esi, dword [ebp - 0x218]
lea edx, [ebp - 0x228]
push ecx
mov dword [ebp - 0x218], edi
call fcn.00401130
add esp, 4
cmp esi, eax
jne 0x4017bf
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x4017a9
mov ecx, 0x80
lea esi, [ebp - 0x228]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, 1
jmp 0x4017bf
push eax
push ecx
push str.Invalid_vlnk_file_length__llu_n
call fcn.00401370
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403088
mov esp, ebp
pop ebp
ret
Function at 0x409f78
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x409f4e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x409f6c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x409fca
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x409fb1
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x409fba
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x409fc4
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x409fa6
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x409f30
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40a017
dec eax
je 0x40a00e
sub eax, 3
je 0x40a005
mov dword [ebp - 4], 0x40
jmp 0x40a034
mov dword [ebp - 4], 4
jmp 0x40a01a
mov dword [ebp - 4], 0x20
jmp 0x40a01a
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40a066
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x409fe6
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00409877
aad 0x2f
inc ecx
inc edx
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x40a072
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409fb2
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x409f4e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x409f6c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x409fca
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x409fb1
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x409fba
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x409fc4
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x409fa6
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x409f30
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40a017
dec eax
je 0x40a00e
sub eax, 3
je 0x40a005
mov dword [ebp - 4], 0x40
jmp 0x40a034
mov dword [ebp - 4], 4
jmp 0x40a01a
mov dword [ebp - 4], 0x20
jmp 0x40a01a
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40a066
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x409fe6
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00409877
aad 0x2f
inc ecx
inc edx
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x40a072
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40aca9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x40accd
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
or eax, 0xfffffc6c
or eax, 0xfffffc6c
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x40ac77
call fcn.00409877
cwde
sal esi, 0xd2
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
invalid
test ebx, esp
clc