joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e004]
jne 0x40100a
repz ret
jmp fcn.00401587

Function at 0x40444b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00401e3b
and dword [ebp - 0x14], 0
cmp dword [0x4508c8], 0
mov dword [ebp - 0x18], eax
jne 0x4044fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4045a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4045a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4508c8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4508cc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4508d0], eax
call edi
push eax
call esi
mov dword [0x4508d8], eax
test eax, eax
je 0x4044fe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4508d4], eax
mov eax, dword [0x4508d4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404557
cmp dword [0x4508d8], ecx
je 0x404557
push eax
call esi
push dword [0x4508d8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404557
test ebx, ebx
je 0x404557
call edi
test eax, eax
je 0x40454e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40454e
test byte [ebp - 8], 1
jne 0x404557
or dword [ebp + 0x10], 0x200000
jmp 0x40458a
mov eax, dword [0x4508cc]
cmp eax, dword [ebp - 0x18]
je 0x40458a
push eax
call esi
test eax, eax
je 0x40458a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40458a
mov eax, dword [0x4508d0]
cmp eax, dword [ebp - 0x18]
je 0x40458a
push eax
call esi
test eax, eax
je 0x40458a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4508c8]
call esi
test eax, eax
je 0x4045a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4045a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x402340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x402398
cmp byte [esi + ebx - 1], 0xa
je 0x40236c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x40415c], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x403240
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
Function at 0x1000e1bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000e1cb
pop dword [ebp - 0x24]
mov eax, 0xac9c6bb7
sub eax, 0x9c9b89ec
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x39135
push 0
mov eax, 0x20f9b48
add eax, 0xdf1a51c
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x2b6071de
add ecx, 0xd49fd669
xor ebx, ebx
add ebx, eax
mov edx, 0x5b3a4aa4
add edx, 0xb4c73b5c
add edx, dword [ebp - 0x24]
mov edi, 0x2337058d
add edi, 0x4bc3d921
add dword [ebp - 4], 0x6afb8b19
mov esi, dword [edx]
mov dword [ebp - 0x20], 0x182d37b8
xor esi, edi
add dword [ebp - 0x18], 0x78f807c1
mov dword [ebx], esi
xor dword [ebp - 0x20], esi
add ebx, 4
add edx, 0x8329c28b
sub edx, 0x8329c287
loop 0x1000e22c
add eax, 0x1a8ef082
add eax, 0xe572236d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x401000
Capabilities:
Execute command

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push 0x24
push 0x402100
push str.Do_you_want_to_enable_.NET_Framework_3.5_
push 0
call esi
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp eax, 6
jne 0x40103b
push str.dism__online__enable_feature__featurename:NetFx3__All
call edi
add esp, 4
push 0x40
push str.Information
push str..NET_Framework_3.5_has_been_enabled.
jmp 0x401056
cmp eax, 7
jne 0x40105a
push str.dism__online__disable_feature__featurename:NetFx3
call edi
add esp, 4
push 0x40
push str.Information
push str..NET_Framework_3.5_has_been_disabled.
push 0
call esi
push 0x24
push str.Restart_Computer
push str.Do_you_want_to_restart_your_computer_now_
push 0
call esi
cmp eax, 6
jne 0x401079
push str.shutdown__r__t_0
call edi
add esp, 4
pop edi
xor eax, eax
pop esi
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40bdb9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40bdc8
pop dword [ebp - 0x48]
mov eax, 0x40bdc8
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xddb935b9
add dword [ebp - 0x58], 0x70990f92
mov dword [ebp - 0x54], 0x95cf768
add dword [ebp - 0x54], 0x28d654dd
mov dword [ebp - 0x50], 0xa6294613
add dword [ebp - 0x50], 0xa622fe1b
mov dword [ebp - 0x4c], 0x4c215233
add dword [ebp - 0x4c], 0xb3deadcd
lea eax, [ebp - 0x58]
push eax
mov eax, 0x130bde27
add eax, 0xed34f22d
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x7a08450
sub dword [ebp - 0x58], 0x932e1afa
mov dword [ebp - 0x54], 0x2fd26309
sub dword [ebp - 0x54], 0xee660194
mov dword [ebp - 0x50], 0xc699fa80
sub dword [ebp - 0x50], 0x632a8e14
mov dword [ebp - 0x4c], 0xf23a70d1
sub dword [ebp - 0x4c], 0xf23a70d1
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xef86ac04
sub eax, 0xef45dbb8
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x37d26
push 0
call eax
mov ecx, 0x4135
xor edi, edi
add edi, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x48]
mov ebx, 0xd6a229b
sub dword [ebp - 0x30], ecx
mov edx, dword [esi]
xor dword [ebp - 0x1c], esi
add edx, ebx
add dword [ebp - 0x1c], 0xc6bd2ceb
mov dword [edi], edx
sub dword [ebp - 0x14], edx
add edi, 4
add esi, 4
loop 0x40bed5
add eax, 0x7d8607eb
add eax, 0x827aefbc
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xf8f7764b
add ecx, 0x74889b5
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x10001800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10001861
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10001822
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0x1000a120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000a12f
pop dword [ebp - 0xc]
mov eax, 0xbb4861dd
add eax, 0x54b83f52
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x418e0
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x4043
mov esi, eax
mov edx, 0x571a327
add edx, 0xaa6ced9
add edx, dword [ebp - 0xc]
mov ebx, 0x4a7827a3
sub dword [ebp - 4], ecx
mov edi, dword [edx]
xor edi, ebx
add dword [ebp - 8], ebx
mov dword [esi], edi
add esi, 0xe9d9e891
add esi, 0x16261773
add edx, 0xef988338
sub edx, 0xef988334
loop 0x1000a17d
add eax, 0xf3df
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10071ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x10071f6b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x10071f22
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x10071f22
cmp esi, ebx
jge 0x10071f22
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10071f65
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10071f65
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783dc]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783dc]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x10071f7d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x100721a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
mov eax, dword [ebp + 8]
je 0x100721c8
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x100721e2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1000a120
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.100762d0
leave
ret 4

Function at 0x100723b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x100723e6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10072445
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1000a120
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1000a120
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1000a120
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100762d0
leave
ret 0x10
Function at 0x10072460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1007248c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x100724bd
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x100724bb
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1000a120
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x100724bd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100762d0
leave
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x51a77b15
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x44be4f4c
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x42c5b0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe8
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [esp + 0xe0], 0x6074
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xac], edx
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc0], edi
mov byte [0x49db13], 0
mov byte [0x4921c3], 0
mov bl, byte [esp + 0xd1]
mov bh, bl
xor bh, 0xbb
mov byte [esp + 0xd1], bh
mov eax, dword [esp + 0xc0]
mov dword [0x438f18], eax
mov eax, dword [esp + 0xc4]
mov dword [0x438f14], eax
mov eax, dword [esp + 0xac]
mov dword [0x438f08], eax
mov eax, dword [esp + 0xb4]
mov dword [0x438f0c], eax
movsd xmm0, qword [esp + 0xd8]
mov eax, dword [esp + 0xb0]
movsd qword [esp + 0xd8], xmm0
mov dword [0x438f10], eax
mov eax, esp
mov dword [eax], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov byte [esp + 0x2b], bl
call eax
sub esp, 4
mov ecx, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [esp + 0x24], eax
call ecx
mov si, word [esp + 0xd2]
mov ecx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x20], eax
mov word [esp + 0x1e], si
call ecx
mov dword [esp + 0xb8], eax
mov ecx, dword [esp + 0xb8]
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [esp + 0x18], eax
call ecx
sub esp, 4
mov ecx, dword [esp + 0xe0]
xor ecx, 0x6074
cmp eax, ecx
jne 0x42c720
jmp 0x42c6fe
mov eax, dword [esp + 0xe0]
add eax, 0xffff9f92
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
sub esp, 4
mov word [esp + 0xd2], 0x5e3e
mov eax, 0x607a
sub eax, dword [esp + 0xe0]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call ecx
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jne 0x42c6da
jmp 0x42c75d
mov eax, 0x6096
sub eax, dword [esp + 0xe0]
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
sub esp, 4
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xc8]
add eax, 0xffff9f8c
cmp ecx, eax
ja 0x42c7b3
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov dword [esp + 0xc8], esp
mov dword [esp + 0xcc], eax
mov dword [esp + 0xdc], 0
mov dword [esp + 0xd8], 0x1669
mov eax, dword [esp + 0x18]
and eax, 0x5612
mov ecx, dword [esp + 0xc8]
shr ecx, 2
mov dword [esp + 0xd4], eax
mov dword [esp + 0xc8], ecx
mov dl, 0x30
mov al, byte [esp + 0x2b]
mul dl
mov byte [esp + 0xd1], al
jmp 0x42c73a
lea eax, [0x42bcee]
lea ecx, [esp + 0x2c]
cvtss2sd xmm0, dword [esp + 0xbc]
mov dword [esp], ecx
mov dword [esp + 4], eax
movsd qword [esp + 8], xmm0
call sub.msvcrt.dll_sprintf
mov ecx, dword [esp + 0xc8]
add ecx, 0xffffffff
mov dword [esp + 0xc8], ecx
mov dword [esp + 0x10], eax
jmp 0x42c73a
Function at 0x42cc00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, 0x9f1a
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0x7c1b
mov dword [esp + 0x54], 0x50fe
mov dword [esp + 0x34], 0x6cb
mov edi, dword [esp + 0x34]
mov dword [esp + 0x50], eax
mov dword [esp + 0x48], ecx
sub esi, dword [esp + 0x54]
mov bx, word [esp + 0x66]
cmp esi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edx
mov word [esp + 0x12], bx
je 0x42cd2c
jmp 0x42cd95
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
and ecx, ecx
and edx, edx
xor eax, 0x50ff
mov esi, dword [esp + 0x20]
add esi, eax
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x20], esi
jmp 0x42cce6
mov eax, 0x50fe
mov ecx, dword [esp + 0x20]
sub eax, dword [esp + 0x54]
mov byte [esp + 0x47], 0xa1
and ecx, 0xf
mov dl, byte [esp + 0x47]
mov si, word [esp + 0x12]
add si, si
mov word [esp + 0x66], si
add eax, ecx
mov ecx, dword [esp + 0x2c]
mov dh, byte [ecx + eax]
mov byte [esp + 0x1f], dh
cmp dl, 0x6e
jbe 0x42cc6c
jmp 0x42cd5e
mov eax, dword [esp + 0x4c]
cmp eax, dword [esp + 0x24]
jb 0x42cc95
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
xor edx, edx
mov esi, 0xb413
sub esi, eax
sbb edx, ecx
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x4c], eax
mov bl, byte [esp + 0x77]
or bl, 0x10
mov eax, dword [esp + 0x50]
mov byte [esp + 0x77], bl
mov dword [esp + 0x24], eax
xor esi, 0x7e40
or esi, edx
mov dword [esp + 0xc], esi
jne 0x42ccd2
jmp 0x42ccdc
mov eax, dword [esp + 0x54]
add eax, 0x58d
mov ecx, esp
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
mov dword [ecx], 0
call fcn.0042cdd0
mov dword [esp + 0x78], 0x686c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov al, byte [esp + 0x1f]
mov byte [esp + 0x2b], al
mov al, byte [esp + 0x2b]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x20]
movsx ecx, byte [ecx + edx]
movsx edx, al
sub ecx, edx
mov al, cl
mov byte [esp + 0x1e], al
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
mov al, byte [esp + 0x1e]
mov byte [edx + ecx], al
jmp 0x42cc6c
lea eax, [0x42bd38]
mov ecx, 0x50fe
mov edx, 0x4f8d
mov esi, dword [esp + 0x18]
sub edx, esi
mov edi, dword [esp + 0x54]
mov dword [esp + 0x78], edx
sub ecx, edi
mov edx, dword [esp + 0x14]
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], ecx
jmp 0x42cce6
Function at 0x42d710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov byte [esp + 0x93], 0xaf
mov al, byte [esp + 0x7f]
mov cl, al
and cl, cl
mov byte [esp + 0x7f], cl
mov dword [esp + 0x78], 0x2dda
mov byte [esp + 0x10], 0x6b
mov byte [esp + 0x11], 0x65
mov byte [esp + 0x12], 0x72
mov edx, dword [esp + 0x8c]
mov byte [esp + 0x13], 0x6e
mov byte [esp + 0x14], 0x65
mov cl, byte [esp + 0x93]
add cl, 0xbd
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], 0x33
mov byte [esp + 0x17], 0x32
mov cl, byte [esp + 0x93]
add cl, 0x7f
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], 0x64
mov byte [esp + 0x1a], 0x6c
mov byte [esp + 0x1b], 0x6c
mov esi, edx
xor esi, 0xffffffff
mov dword [esp + 0x8c], esi
mov byte [esp + 0x1c], 0
mov dword [esp + 0x30], 0
mov esi, edx
imul esi, esi
mov dword [esp + 0x8c], esi
mov byte [esp + 0xf], al
mov dword [esp + 8], edx
jmp 0x42d81c
mov eax, dword [esp + 0x30]
mov ecx, eax
movsx eax, byte [esp + eax + 0x10]
mov dx, ax
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0x81d1
mov word [esp + ecx*2 + 0x38], dx
mov al, 0x6b
mov ecx, dword [esp + 8]
sub ecx, 0x7a6f
mov dword [esp + 0x8c], ecx
mov dl, byte [esp + 0x93]
xor dl, 0xee
mov byte [esp + 0x37], dl
mov dl, byte [esp + 0x37]
mov ah, byte [esp + 0xf]
sub al, ah
mov byte [esp + 0x7f], al
cmp dl, 0x9d
jne 0x42d842
jmp 0x42d82f
mov eax, 0x2dfa
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x30]
sub eax, ecx
cmp edx, eax
jne 0x42d7bd
mov eax, esp
lea ecx, [esp + 0x38]
mov dword [eax], ecx
call fcn.0042da30
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0x30]
add eax, 1
mov dword [esp + 0x30], eax
jmp 0x42d81c
Function at 0x42da30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov eax, dword [ebp + 8]
mov cx, word [esp + 0x5a]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0x5123
mov word [esp + 0x46], 0x424c
mov dword [esp + 0x40], 0x2a05
mov edx, dword [esp + 0x48]
mov esi, dword [esp + 0x4c]
xor edi, edi
mov ebx, 0xce59
sub ebx, edx
mov edx, edi
sbb edx, esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edx
mov esi, 0x7794
sub esi, ebx
sbb edi, edx
mov dword [esp + 0x20], eax
mov word [esp + 0x1e], cx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
jb 0x42dac5
jmp 0x42dad6
mov eax, dword [esp + 0x24]
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 4], 0
call fcn.0042dcb0
sub esp, 8
mov dword [esp + 0x3c], eax
jmp 0x42dafa
mov eax, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
jmp 0x42dafa
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0
je 0x42db08
jmp 0x42da9e
mov eax, dword [esp + 0x40]
xor eax, 0x44bb
mov ecx, esp
mov dword [ecx], eax
call fcn.0042e000
xor ecx, ecx
mov dword [esp + 0x10], eax
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [esp + 0x3c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ax, word [esp + 0x46]
xor ax, 0x7611
mov word [esp + 0x3a], ax
mov cl, byte [esp + 0x59]
mov byte [esp + 0x59], cl
mov ax, word [esp + 0x3a]
mov word [esp + 0xe], ax
call fcn.0042db60
mov dx, 0x1d99
mov dword [esp + 0x34], eax
mov si, word [esp + 0x1e]
imul di, si, 0x3394
mov word [esp + 0x5a], di
mov cl, byte [esp + 0x59]
mov byte [esp + 0x59], cl
mov di, word [esp + 0xe]
cmp dx, di
ja 0x42db08
jmp 0x42dabb

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx