joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4906e7
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x60cb9f
call fcn.0060bcd8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
inc ebx
cmp dword [ecx + 8], ebx
jne 0x490805
mov ecx, dword [ecx + 0xc]
cmp ecx, ebx
jne 0x490719
mov ecx, esi
call fcn.00491c25
mov eax, ebx
jmp 0x49080e
cmp ecx, 2
jne 0x49073a
cmp byte [esi + 0x5f2], 0
jne 0x49072d
mov byte [esi + 0x5f2], bl
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x490712
cmp ecx, 0x65
jne 0x490748
mov ecx, esi
call fcn.00491d43
jmp 0x490712
cmp ecx, 0x66
jne 0x490762
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x584], eax
sete al
push eax
call fcn.00492c8b
jmp 0x490712
cmp ecx, 0x191
jne 0x490773
mov ecx, esi
call fcn.00491e37
jmp 0x490712
cmp ecx, 0x96
jne 0x49079d
push dword [esi + 0x5b0]
push dword [esi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0
mov ecx, esi
call fcn.0049178f
jmp 0x490712
cmp ecx, 0x1f5
jne 0x4907b1
mov ecx, esi
call fcn.00491ea3
jmp 0x490712
cmp ecx, 0xa0
jne 0x4907c3
call fcn.00491f91
jmp 0x490712
cmp ecx, 0x68
jne 0x4907d4
mov ecx, esi
call fcn.004929fe
jmp 0x490712
cmp ecx, 0x2bf
jne 0x490805
push str.https:__www.ijinshan.com_privacy_dubaPrivacy.html
lea ecx, [ebp + 8]
call fcn.00406173
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00470be1
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
jmp 0x490712
and dword [esi + 0x5b4], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001af30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x228
push ebx
push ebp
mov ebp, dword [esp + 0x238]
push esi
mov eax, ebp
push edi
and eax, 0x8000000f
jns 0x1001af4f
dec eax
or eax, 0xfffffff0
inc eax
jne 0x1001b15b
mov bl, byte [esp + 0x250]
test bl, bl
je 0x1001af69
cmp bl, 1
jne 0x1001b15b
mov al, byte [esp + 0x24c]
cmp al, 1
je 0x1001af7c
test al, al
jne 0x1001b15b
mov eax, dword [esp + 0x248]
test eax, eax
je 0x1001afa4
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
jmp 0x1001afb6
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x34]
push 0x80
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x248]
lea edx, [esp + 0x38]
push ecx
push edx
call fcn.100187b0
add esp, 0xc
test bl, bl
jne 0x1001b0a4
test ebp, ebp
jle 0x1001b15b
mov esi, dword [esp + 0x23c]
lea eax, [ebp + 0xf]
shr eax, 4
mov dword [esp + 0x30], eax
cmp bl, 1
jne 0x1001b15b
test ebp, ebp
jle 0x1001b15b
mov esi, dword [esp + 0x23c]
lea edi, [ebp + 0xf]
shr edi, 4
mov eax, esi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x10]
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], edx
push eax
lea edx, [esp + 0x38]
push ecx
push edx
call fcn.10019e00
mov al, byte [esp + 0x258]
add esp, 0xc
cmp al, 1
jne 0x1001b134
xor eax, eax
mov cl, byte [esp + eax + 0x20]
mov bl, byte [esp + eax + 0x10]
xor bl, cl
mov byte [esp + eax + 0x10], bl
inc eax
cmp eax, 0x10
jl 0x1001b103
mov edx, esi
mov eax, dword [edx]
mov dword [esp + 0x20], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x24], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x28], eax
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, esi
add esi, 0x10
dec edi
mov dword [edx], eax
mov eax, dword [esp + 0x18]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
jne 0x1001b0c2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x228
ret

Function at 0x1001b1b0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x10022b24
push 8
push edi
call fcn.1001b170
add esp, 8
mov edx, 8
shl eax, 0x18
mov dword [esi], eax
mov ebx, eax
mov ecx, ebx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
dec edx
mov ebx, eax
jne 0x1001b1d1
push 0x20
push eax
mov dword [esi], ebx
call fcn.1001b170
mov dword [esi], eax
add esp, 8
add esi, 4
inc edi
cmp esi, 0x10022f20
jle 0x1001b1ba
pop edi
pop esi
pop ebx
ret
Function at 0x1001b210
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
test edx, edx
je 0x1001b243
push ebx
push esi
lea esi, [edx]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10022b24]
xor eax, edx
inc ecx
dec esi
jne 0x1001b223
pop esi
pop ebx
not eax
ret

Function at 0x1001b250
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret
Function at 0x1001cdc0
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10017f88
push 0x1001d7c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x1c], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x1c]
pop ebx
pop ecx
pop edx
jmp 0x1001ce35
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
and eax, 0xff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10021778
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x10018394
sub eax, eax
test esi, esi
je 0x10021850
sub eax, 1
test ecx, ecx
je 0x1002184e
test esi, 3
je 0x100217b6
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x1002179b
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x10021835
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x100217c0
mov ecx, edx
test ecx, ecx
je 0x1002184e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x1002183b
not eax
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x444120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x39000]
push edi
or ebp, 0xffffffff
jmp 0x444142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x444149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x444138
mov eax, 1
add ebx, ebx
jne 0x44415b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x444150
jne 0x44416c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x444150
xor ecx, ecx
sub eax, 3
jb 0x444180
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4441f2
mov ebp, eax
add ebx, ebx
jne 0x44418b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x444198
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4441bc
inc ecx
add ebx, ebx
jne 0x4441a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44419d
jne 0x4441b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44419d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4441dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4441cd
jmp 0x44413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4441dc
add edi, ecx
jmp 0x44413e
pop esi
mov edi, esi
mov ecx, 0x483
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4441fa
cmp byte [edi], 6
jne 0x4441fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4441ff
lea edi, [esi + 0x42000]
mov eax, dword [edi]
or eax, eax
je 0x44426e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x460f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x46164]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44422c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4616c]
or eax, eax
je 0x444268
mov dword [ebx], eax
add ebx, 4
jmp 0x444249
call dword [esi + 0x46168]
mov ebp, dword [esi + 0x46170]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4442a2
sub esp, 0xffffff80
jmp 0x406f00
Function at 0x1e7a3ff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1e7a3c78
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a3c2d
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1e7a3c78
push eax
push esi

Function at 0x1e7a40f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.1e7a3c68
adc byte [ebp - 0x7a72d1dd], cl
invalid
invalid
jl 0x1e7a4153
invalid
invalid

Function at 0x1e7a44d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x56fffffc], edi
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
inc dword [esi + eax*8 - 0x7b]
mov ebp, 0x55fffffc
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.1e7a3c78
pop ecx
push eax
push dword [ebp + 0x18]
sbb bh, bh
jne 0x1e7a4528
call fcn.1e7a3c2d
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
invalid
inc dword [ebx]
Function at 0x1e7a44f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x56fffffc], edi
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
inc dword [esi + eax*8 - 0x7b]
mov ebp, 0x55fffffc
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.1e7a3c78
pop ecx
push eax
push dword [ebp + 0x18]
sbb bh, bh
jne 0x1e7a4528
call fcn.1e7a3c2d
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
invalid
inc dword [ebx]

Function at 0x1e7a4510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x56fffffc], edi
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
inc dword [esi + eax*8 - 0x7b]
mov ebp, 0x55fffffc
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.1e7a3c78
pop ecx
push eax
push dword [ebp + 0x18]
sbb bh, bh
jne 0x1e7a4528
call fcn.1e7a3c2d
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
invalid
inc dword [ebx]
Function at 0x1e7a4590
Capabilities:
Encode data using xor

Disassembly:
inc dword [ebx]
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
sub eax, esi
test dword [esp + edi*8 - 1], eax
dec dword [ecx]
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.1e7a3c78
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a3c2d
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
test dword [ecx], ebx
cld
invalid
dec dword [ebx - 0x3e57a3a]
invalid
call [edx - 0x3e47a3a]
invalid
jmp dword [ebx - 0x3e37a3a]
invalid
invalid
invalid
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
and bh, ah
invalid
dec dword [edi - 0x3dc7a3a]
invalid
inc dword [eax - 0x3db7a3a]
invalid
dec dword [edx - 0x3da7a3a]
invalid
inc dword [edx - 0x3d97a3a]
invalid
dec dword [ebx - 0x3d87a3a]
invalid
jmp [edi - 0x3d77a3a]
invalid
invalid
out dx, al
lea eax, [ebp - 0x3ec]
push eax
call fcn.1e7a3c78
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e7a3c2d
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.1e7a3c68
xor edi, dword [ebx - 0xc]
ja 0x1e7a465b
movsd dword es:[edi], dword [esi]
int3

Function at 0x1e7a4ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esi - 0x55000004], edx
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
invalid
invalid
invalid
cld
invalid

Function at 0x1e7a4bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
cld
invalid
jmp dword [edi]
mov byte [ebp - 0x357], 0x2c
invalid
invalid
stosb byte es:[edi], al
cld
invalid

Function at 0x1e7a5090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x1e7a50be
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
invalid
Function at 0x1e7a50f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esp
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.1e7a3c68
call dword [esi]

Function at 0x1e7a7500
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 4], 0x1e7ba2c0
je 0x1e7a751c
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
ret 8
mov eax, dword [eax + 8]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [esp + 8]
cmp ecx, 2
jne 0x1e7a7541
test eax, eax
je 0x1e7a754a
mov eax, dword [sym.imp.python27.dll__Py_TrueStruct]
inc dword [eax]
ret 8
cmp ecx, 3
jne 0x1e7a7554
test eax, eax
je 0x1e7a7537
mov eax, dword [sym.imp.python27.dll__Py_ZeroStruct]
inc dword [eax]
ret 8
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
ret 8

Function at 0x1e7a9c90
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], 0
push ebx
mov ebx, dword [sym.imp.python27.dll_Py_FatalError]
push esi
push edi
mov edi, dword [sym.imp.python27.dll_PyThreadState_Swap]
jne 0x1e7a9ccd
push 0
call edi
mov esi, eax
add esp, 4
test esi, esi
jne 0x1e7a9cbf
push str.pywintypes:_can_not_setup_interpreter_state__as_current_state_is_invalid
call ebx
add esp, 4
mov eax, dword [esi + 4]
push esi
mov dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], eax
call edi
add esp, 4
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x1e7a9ce7
push 0x1e7b10fc
call ebx
add esp, 4
mov ecx, dword [0x1e7ba8b8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
call edi
push eax
mov dword [esi], eax
call edi
add esp, 8
pop edi
mov dword [esi + 4], 0
pop esi
pop ebx
ret
Function at 0x2580180d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x25818bec]
jne 0x25801817
repz ret
jmp fcn.258128c0
Function at 0x402bd0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x473008], 0x8088405
inc edx
mov dword [ebx + 0x473008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403028
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x473024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4030c0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4030a0
xor eax, eax
push ebp
push 0x403099
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4030dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4030a0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x473024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x473024], ax
mov esp, ebp
pop ebp
ret

Function at 0x403d84
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x475048], 0
je 0x403de5
cmp word [0x47521c], 0xd7b2
jne 0x403dad
cmp dword [0x475224], 0
jbe 0x403dad
mov eax, 0x475218
call dword [0x475234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x473070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e0c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x473034], 0
jne 0x403e01
push 0
push 0x473068
push 0x473070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403f38
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004026dc
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x475049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403f00
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc