joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402160
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
lea eax, [ebp - 0x68]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x54]
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x4021c7
push str.GetCpuUsageRatio_GetProcessTimes_failed_n
call fcn.00409810
add esp, 4
xorps xmm0, xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x24]
mov eax, edi
add esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
adc ecx, dword [ebp - 0x28]
cdq
push edx
push eax
push ecx
push esi
call fcn.0040c360
mov ecx, dword [0x4136e8]
mov edi, eax
or ecx, dword [0x4136ec]
mov ebx, edx
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], eax
je 0x4022cd
mov ecx, dword [0x4136e0]
mov eax, ecx
mov edx, dword [0x4136e4]
or eax, edx
je 0x4022ca
push dword [ebp - 0xc]
mov eax, edi
sub eax, dword [0x4136e8]
mov dword [ebp - 0x1c], eax
sbb ebx, dword [0x4136ec]
mov dword [ebp - 0x18], ebx
mov ebx, esi
mov esi, dword [ebp - 4]
sub ebx, ecx
sbb esi, edx
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
or eax, esi
jne 0x402260
push str.GetCpuUsageRatio_time_delta_is_0__error_n
call fcn.00409810
add esp, 4
xorps xmm0, xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
push 0
push 0x64
push dword [ebp - 0x18]
mov dword [0x4136ec], eax
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x1c]
mov dword [0x4136e0], eax
mov eax, dword [ebp - 4]
mov dword [0x4136e8], edi
mov dword [0x4136e4], eax
call fcn.0040c2f0
push 0
push 2
push dword [ebp - 8]
mov edi, eax
mov esi, edx
push ebx
call fcn.0040c240
push dword [ebp - 8]
add edi, eax
push ebx
adc esi, edx
push esi
push edi
call fcn.0040c240
movd xmm0, eax
cvtdq2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm0, qword [0x40f868]
cvtpd2ps xmm0, xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [0x4136e8], edi
xorps xmm0, xmm0
pop edi
mov dword [0x4136e0], esi
pop esi
mov dword [0x4136ec], ebx
mov dword [0x4136e4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4022f0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x40e01c
push 0x8c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
jne 0x402344
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40233b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402c10
Capabilities:
Enumerate process modules
Enumerate processes
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x413014]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 0x248], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x250]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea ecx, [ebp - 0x24c]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea ecx, [ebp - 0x240]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_8672]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x402cab
cmp dword [0x414728], 0
push 0
push 0
jne 0x402c98
push 0x40e09c
jmp 0x402c9d
push str.Failed_to_get_the_process_handle
call dword [sym.imp.mfc140.dll_Ordinal_2298]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x128
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
mov edi, dword [ebp - 0x234]
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x402d11
lea eax, [ebp - 0x258]
push eax
push 4
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x402d11
push 0x104
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x254]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x240]
push 0x40d958
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0xc
lea ecx, [ebp - 0x240]
call dword [sym.imp.mfc140.dll_Ordinal_5898]
push eax
lea ecx, [ebp - 0x244]
call dword [sym.imp.mfc140.dll_Ordinal_305]
mov eax, dword [ebp - 0x240]
push 2
push 0x40e0d4
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_3005]
add esp, 0x14
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x244]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x240]
call dword [sym.imp.mfc140.dll_Ordinal_8672]
push dword [ebp - 0x240]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x402dbf
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x402cc3
jmp 0x402dc9
mov dword [ebp - 0x248], 1
push ebx
call esi
lea ecx, [ebp - 0x240]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x24c]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x250]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
cmp dword [ebp - 0x248], 1
jne 0x402e15
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040b2ce
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b2ce
mov esp, ebp
pop ebp
ret
Function at 0x4069b0
Capabilities:
Download url
Read .ini file
Receive data
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x413014]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
lea ecx, [ebp - 0x6c]
push 0x40d967
call dword [sym.imp.mfc140.dll_Ordinal_310]
push 0x40d967
lea ecx, [ebp - 0x7c]
call dword [sym.imp.mfc140.dll_Ordinal_310]
push 0x40d967
lea ecx, [ebp - 0x78]
call dword [sym.imp.mfc140.dll_Ordinal_310]
push str.http:__47.92.37.72:8088_DownLoad_Version.ini
lea ecx, [ebp - 0x74]
call dword [sym.imp.mfc140.dll_Ordinal_310]
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, 0x414824
call dword [sym.imp.mfc140.dll_Ordinal_5898]
push eax
lea ecx, [ebp - 0x70]
call dword [sym.imp.mfc140.dll_Ordinal_305]
mov eax, dword [0x414824]
push 0xc
push str._version.ini
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_3005]
add esp, 0x14
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x6c]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_1526]
lea ecx, [ebp - 0x70]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push dword [ebp - 0x74]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push 0
push 0
push dword [ebp - 0x6c]
push dword [ebp - 0x74]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x406b46
push dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push 0x64
push eax
push str.1.1.1.1
push 0x40e530
push str.Version_ProgramProtect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x7c]
push 0x40d958
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0xc
lea eax, [ebp - 0x68]
push dword [ebp - 0x6c]
push 0x64
push eax
push 0x40d954
push str.AutoUpgrade
push str.Version_ProgramProtect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
mov dword [edi + 0x114], eax
lea ecx, [ebp - 0x7c]
push str.22.12.14.06
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x406b13
lea eax, [ebp - 0x78]
push 0x40e558
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 8
mov ecx, edi
push dword [ebp - 0x78]
push 0x3fa
call dword [sym.imp.mfc140.dll_Ordinal_13407]
push 1
jmp 0x406b31
push 0x40d967
push 0x3fa
mov ecx, edi
mov dword [edi + 0x114], 0
call dword [sym.imp.mfc140.dll_Ordinal_13407]
push 0
push 0x3fa
mov ecx, edi
call dword [sym.imp.mfc140.dll_Ordinal_5401]
mov ecx, eax
call dword [sym.imp.mfc140.dll_Ordinal_14149]
lea ecx, [ebp - 0x74]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x78]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x7c]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x6c]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0040b2ce
mov esp, ebp
pop ebp
ret
Function at 0x406b80
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
lea ecx, [ebp - 0x10]
push 0x40d967
call dword [sym.imp.mfc140.dll_Ordinal_310]
push 0x40d967
lea ecx, [ebp - 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_310]
push 0x40d967
lea ecx, [ebp - 4]
call dword [sym.imp.mfc140.dll_Ordinal_310]
mov esi, dword [sym.imp.mfc140.dll_Ordinal_4807]
lea eax, [ebp - 4]
push str.http:__47.92.37.72:8088_DownLoad_UPG_ProgramProtect.exe
push 0x40d958
push eax
mov dword [ebp - 0x18], vtable.CBindCallback.0
mov dword [ebp - 0x14], ebx
call esi
add esp, 0xc
mov ecx, 0x414824
call dword [sym.imp.mfc140.dll_Ordinal_5898]
push eax
lea ecx, [ebp - 8]
call dword [sym.imp.mfc140.dll_Ordinal_305]
mov eax, dword [0x414824]
push 0x17
push str.UPG_ProgramProtect.exe
push dword [eax - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_3005]
add esp, 0x14
lea eax, [ebp - 8]
lea ecx, [ebp - 0x10]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_1526]
lea ecx, [ebp - 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp - 0x10]
push dword [ebp - 4]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x406c45
xor esi, esi
jmp 0x406ca6
push eax
lea eax, [ebp - 0xc]
push 0x40e5bc
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0xc]
push 0
push eax
push 0x466
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.mfc140.dll_Ordinal_5401]
mov ecx, ebx
push 5
push 0x3fa
call edi
mov esi, dword [sym.imp.mfc140.dll_Ordinal_14149]
mov ecx, eax
call esi
push 0
push 0x3f8
mov ecx, ebx
call edi
mov ecx, eax
call esi
push 0
push 0x3f9
mov ecx, ebx
call edi
mov ecx, eax
call esi
mov esi, 1
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], vtable.CBindCallback.0
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4073c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c0
mov eax, dword [0x413014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x413708]
push edi
mov edi, ecx
mov dword [ebp - 0x1b0], esi
lea ecx, [ebp - 0x1bc]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea ecx, [ebp - 0x1ac]
call dword [sym.imp.mfc140.dll_Ordinal_316]
mov eax, dword [0x414714]
mov dword [0x414718], 1
test eax, eax
je 0x40741a
cmp eax, 0xffffffff
je 0x40741a
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
lea eax, [ebp - 0x1a8]
mov dword [0x414714], 0
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x407446
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSAStartup_error_errCode_d
jmp 0x40747c
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x414714], eax
cmp eax, 0xffffffff
jne 0x4074aa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
push dword [0x414714]
call dword [sym.imp.WS2_32.dll_closesocket]
push esi
push str.socket_error_errCode_d
lea eax, [ebp - 0x1ac]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0xc
lea eax, [ebp - 0x1ac]
push 0
push eax
push 0x466
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
xor esi, esi
jmp 0x4075b7
mov eax, 2
push esi
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push dword [ebp + 8]
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [0x414714]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x407571
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, 0x414840
push eax
call fcn.004096c0
mov esi, eax
lea eax, [ebp - 0x1b4]
push ecx
push eax
mov ecx, 0x414834
call fcn.004096c0
push dword [esi]
push dword [eax]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [ebp - 0x1b0]
lea eax, [ebp - 0x1ac]
push dword [ebp + 8]
push 0x40e6d4
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x1c
lea ecx, [ebp - 0x1b4]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x1b8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push 0
lea eax, [ebp - 0x1ac]
push eax
push 0x466
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x414714], 0
xor esi, esi
jmp 0x4075b7
push dword [0x414714]
lea eax, [ebp - 0x1ac]
push esi
push dword [ebp + 8]
push 0x40e710
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x14
lea eax, [ebp - 0x1ac]
push 0
push eax
push 0x466
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [0x414714]
mov dword [0x414718], 0
lea ecx, [ebp - 0x1ac]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x1bc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0040b2ce
mov esp, ebp
pop ebp
ret 8
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1002aaee
pop dword [ebp - 0x48]
mov eax, 0x1002aaee
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x1865dc4e
sub dword [ebp - 0x58], 0xca139703
mov dword [ebp - 0x54], 0x45350199
sub dword [ebp - 0x54], 0x1301b554
mov dword [ebp - 0x50], 0xd52228d9
sub dword [ebp - 0x50], 0x88d5e4ab
mov dword [ebp - 0x4c], 0x96ca7b18
sub dword [ebp - 0x4c], 0x96ca7b18
lea eax, [ebp - 0x58]
push eax
mov eax, 0xf9f14eea
add eax, 0x1611714e
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x5c9059b4
add dword [ebp - 0x58], 0x17e20fa2
mov dword [ebp - 0x54], 0x6db1c28
sub dword [ebp - 0x54], 0xc56ebab3
mov dword [ebp - 0x50], 0x4cd32ef7
add dword [ebp - 0x50], 0x169c3d75
mov dword [ebp - 0x4c], 0xa6cb7f6d
add dword [ebp - 0x4c], 0x59348093
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x36800
push 0
call eax
mov ecx, 0x82db0f8b
sub ecx, 0x82dac76a
xor ebx, ebx
add ebx, eax
mov edx, 0x10039600
add edx, dword [ebp - 0x48]
mov edi, 0x43796782
xor dword [ebp - 8], 0xbfd85c3d
mov esi, dword [edx]
xor dword [ebp - 0x24], 0xf8a22f5
add esi, edi
mov dword [ebp - 0x10], 0x483fb6f0
mov dword [ebx], esi
add dword [ebp - 0x3c], 0x81a4a3cb
add ebx, 4
add edx, 0xa3cbb13c
sub edx, 0xa3cbb138
loop 0x1002abfc
add eax, 0x80408f00
sub eax, 0x803f7ba9
mov ebx, eax
add eax, 0x6aefcc8b
sub eax, 0x6aefcc86
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409348
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x409369
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
invalid
inc ebp

Function at 0x409f78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00409059
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040908b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00409040
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040907b
cmp byte [ebp + 0x468f432], bl
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
Function at 0x40a481
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x40a4d1
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x40a47b
call fcn.0040907b
je 0x40a553
outsd dx, dword [esi]
xchg byte [eax - 0x72b5b], al
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0040907b
add byte [edi + 0x48], 0x20
lea eax, [ebp - 0x72c]
push eax
call fcn.0040908b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00409040
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.0040907b
mov ebx, 0x8d9fa82e
test eax, ebp
clc
invalid
in eax, 0xf8
invalid

Function at 0x40af9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [0x9cfffff8], ebp
mov byte [ebp - 0x7d2], 0xc0
mov byte [ebp - 0x7d1], 0x82
mov byte [ebp - 0x7d0], 0x81
mov byte [ebp - 0x7cf], 0x89
mov byte [ebp - 0x7ce], 0xee
push 0xb
lea eax, [ebp - 0x7dc]
push eax
call fcn.0040908b
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00408fec
add esp, 0xc
jmp 0x40aff3
Function at 0x10003ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10003ece
pop dword [ebp - 0x40]
mov eax, 0xce1d7d17
add eax, 0x41e2c1b7
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x97a2e7bc
add dword [ebp - 0x50], 0xb6af5d8f
mov dword [ebp - 0x4c], 0x1b06d1f7
sub dword [ebp - 0x4c], 0xe8d385b2
mov dword [ebp - 0x48], 0xe88bad71
add dword [ebp - 0x48], 0x63c096bd
mov dword [ebp - 0x44], 0xb9a01756
sub dword [ebp - 0x44], 0xb9a01756
lea eax, [ebp - 0x50]
push eax
mov eax, 0xa1e51f56
sub eax, 0x91e4cf12
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x3198ebfa
add dword [ebp - 0x50], 0x42d97d5c
mov dword [ebp - 0x4c], 0x30999e39
add dword [ebp - 0x4c], 0x10d2c33c
mov dword [ebp - 0x48], 0xf9cf9861
sub dword [ebp - 0x48], 0x96602bf5
mov dword [ebp - 0x44], 0xfe3e3a12
add dword [ebp - 0x44], 0x1c1c5ee
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xec1b5811
add eax, 0x23e4f82f
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3bbc6
push 0
call eax
mov ecx, 0x718e7c8d
sub ecx, 0x718e2024
xor edi, edi
add edi, eax
mov ebx, 0x5a947968
add ebx, 0xb56c3c98
add ebx, dword [ebp - 0x40]
mov edx, 0x39dab8a9
add dword [ebp - 4], eax
mov esi, dword [ebx]
xor dword [ebp - 0x24], 0x15855182
sub esi, edx
mov dword [edi], esi
sub dword [ebp - 0xc], 0x703dfec2
add edi, 0xe2815d53
add edi, 0x1d7ea2b1
add ebx, 0x4253abbc
add ebx, 0xbdac5448
loop 0x10003fec
add eax, 0x2daae58a
add eax, 0xd2567eed
xor ebx, ebx
add ebx, eax
add eax, 0xbea8a653
add eax, 0x415759b2
mov ecx, 0x8a8dd9f9
add ecx, 0x85722607
add ecx, dword [ebp - 0x40]
call ebx
leave
ret