joyce8/EMBER2024-capa huggingface dataset:
Function at 0x624011a4
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, 0x10
mov esi, dword [ebp - 0x20]
cmp dword [ebp - 0x2c], esi
je 0x62401373
cmp eax, 0x10
jne 0x62401361
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x1c]
mov ecx, 4
lea edx, [ebp - 0x1c]
lea esi, [eax + 0xf0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
call fcn.62401028
mov dword [ebp - 0x28], 1
lea edx, [ebp - 0x1c]
lea edi, [ebp - 0x18]
mov ecx, edx
mov byte [ebp - 0x21], 0
mov eax, ecx
movzx esi, byte [eax]
inc byte [ebp - 0x21]
add eax, 4
mov bl, byte [esi + str.cw]
mov byte [eax - 4], bl
cmp byte [ebp - 0x21], 4
jne 0x62401207
inc ecx
cmp edi, ecx
jne 0x62401201
mov al, byte [ebp - 0x17]
mov cl, byte [ebp - 0x1b]
cmp dword [ebp - 0x28], 0xe
mov byte [ebp - 0x1b], al
mov al, byte [ebp - 0x13]
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0xf]
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0x1a]
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0x12]
mov byte [ebp - 0x12], cl
mov cl, byte [ebp - 0x16]
mov byte [ebp - 0x1a], al
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0x19]
mov byte [ebp - 0x16], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 0x19], al
mov al, byte [ebp - 0x11]
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0x15]
mov byte [ebp - 0x15], cl
mov byte [ebp - 0x11], al
je 0x62401321
lea eax, [edx + 0x10]
mov dword [ebp - 0x30], eax
mov al, byte [edx]
mov cl, byte [edx + 1]
mov bl, 0x1b
add edx, 4
xor ecx, eax
mov byte [ebp - 0x21], al
mov al, byte [edx - 2]
xor al, byte [edx - 1]
movzx edi, byte [ebp - 0x21]
mov byte [ebp - 0x22], al
mov esi, eax
mov eax, ecx
shr al, 7
xor esi, ecx
add ecx, ecx
imul eax, ebx
xor edi, esi
xor edi, eax
mov al, byte [edx - 3]
xor al, byte [edx - 2]
xor ecx, edi
mov edi, eax
shr al, 7
imul eax, ebx
mov byte [edx - 4], cl
mov ecx, esi
xor cl, byte [edx - 3]
add edi, edi
xor ecx, eax
mov al, byte [ebp - 0x22]
xor ecx, edi
movzx edi, byte [edx - 1]
shr al, 7
mov byte [edx - 3], cl
mov ecx, esi
xor cl, byte [edx - 2]
imul eax, ebx
xor esi, edi
xor ecx, eax
mov al, byte [ebp - 0x22]
add eax, eax
xor eax, ecx
mov cl, byte [ebp - 0x21]
xor cl, byte [edx - 1]
mov byte [edx - 2], al
mov eax, ecx
add ecx, ecx
shr al, 7
imul eax, ebx
xor esi, eax
xor ecx, esi
mov byte [edx - 1], cl
cmp dword [ebp - 0x30], edx
jne 0x6240127c
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
call fcn.62401028
inc dword [ebp - 0x28]
jmp 0x624011f9
mov ecx, dword [ebp + 8]
mov eax, 0xe
lea edx, [ebp - 0x1c]
call fcn.62401028
mov eax, 0xf
mov edi, dword [ebp + 8]
mov dl, byte [edi + eax + 0xf0]
cmp dl, 0xff
jne 0x62401354
mov byte [edi + eax + 0xf0], 0
sub eax, 1
jae 0x62401336
jmp 0x6240135f
mov edi, dword [ebp + 8]
inc edx
mov byte [edi + eax + 0xf0], dl
xor eax, eax
mov ebx, dword [ebp - 0x20]
mov dl, byte [ebp + eax - 0x1c]
inc eax
inc dword [ebp - 0x20]
xor byte [ebx], dl
jmp 0x624011be
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6240a670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov dword [esp + 4], ebx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
mov dword [esp], eax
call fcn.62410cf8
mov dword [esp + 4], ebx
lea esi, [ebx + eax]
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call fcn.62410cf8
mov dword [esp + 4], ebx
add eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x24]
mov dword [esp], eax
call fcn.62410cf8
add eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [edi + edi]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], edi
je 0x6240a734
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], ebx
mov eax, dword [eax + edi*4]
mov dword [esp], eax
call fcn.62410cf8
lea ecx, [ebx + eax]
mov dword [esp], ecx
mov dword [ebp - 0x2c], ecx
call fcn.6240abfc
mov ecx, dword [ebp - 0x2c]
cmp eax, 0xa6caa1c5
jne 0x6240a722
mov dword [esp + 4], ebx
mov eax, dword [esi + 0x1c]
mov dword [esp], eax
call fcn.62410cf8
mov edx, dword [ebp - 0x28]
mov dword [esp + 4], ebx
add eax, ebx
movzx edx, word [edx]
mov eax, dword [eax + edx*4]
mov dword [esp], eax
call fcn.62410cf8
jmp 0x6240a736
mov dword [esp], ecx
inc edi
call fcn.6240abfc
cmp eax, 0xffe885ef
jne 0x6240a6c2
jmp 0x6240a6fa
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6240a780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x624157c2]
xor edx, edx
test eax, eax
je 0x6240a837
mov edx, dword [0x62415778]
test edx, edx
jne 0x6240a837
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], 0
mov esi, dword [eax + ecx + 0x78]
add esi, eax
mov edi, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
mov ebx, dword [esi + 0x24]
add edi, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 0x20]
add ebx, eax
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
add edi, eax
mov dword [ebp - 0x20], edi
mov edi, dword [ebp - 0x10]
cmp dword [ebp - 0x18], edi
je 0x6240a827
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov esi, dword [edi + ecx*4]
cmp word [eax + esi], 0x775a
jne 0x6240a822
mov edi, dword [ebp - 0x1c]
test ebx, ebx
movzx esi, word [edi + ecx*2]
jne 0x6240a804
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + esi*4]
add ebx, eax
jmp 0x6240a822
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + esi*4]
add edi, eax
mov esi, edi
sub esi, ebx
cmp ebx, edi
jbe 0x6240a818
mov esi, ebx
sub esi, edi
test edx, edx
je 0x6240a820
cmp edx, esi
jbe 0x6240a822
mov edx, esi
inc dword [ebp - 0x10]
jmp 0x6240a7d6
mov dword [0x62415778], edx
add esp, 0x14
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edx
ret
Function at 0x6240aba8
Capabilities:
Hash data using djb2

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x6240abf4
mov ecx, ebx
mov eax, 0x1505
mov dl, byte [ecx]
test esi, esi
jne 0x6240abcd
test dl, dl
jne 0x6240abdb
jmp 0x6240abf4
mov edi, ecx
sub edi, ebx
cmp esi, edi
jbe 0x6240abf4
cmp dl, 1
adc ecx, 0
cmp dl, 0x60
jbe 0x6240abe9
cmp dword [ebp + 0x10], 0
je 0x6240abe9
sub edx, 0x20
imul eax, eax, 0x21
movzx edx, dl
inc ecx
add eax, edx
jmp 0x6240abc1
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6240abfc
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov eax, 0x1505
mov ebp, esp
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x6240ac16
imul eax, eax, 0x21
add eax, edx
jmp 0x6240ac07
pop ebp
ret

Function at 0x6240c43c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
push edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov cl, byte [edx + esi*4]
mov byte [eax + esi*4], cl
mov cl, byte [edx + esi*4 + 1]
mov byte [eax + esi*4 + 1], cl
mov cl, byte [edx + esi*4 + 2]
mov byte [eax + esi*4 + 2], cl
mov cl, byte [edx + esi*4 + 3]
mov byte [eax + esi*4 + 3], cl
inc esi
cmp esi, 8
jne 0x6240c44b
mov dl, byte [eax + 0x1e]
mov edi, esi
movzx ebx, byte [eax + 0x1c]
movzx ecx, byte [eax + 0x1d]
mov byte [ebp - 0xd], dl
mov dl, byte [eax + 0x1f]
mov byte [ebp - 0xe], dl
and edi, 7
jne 0x6240c4c2
movzx edx, byte [ebp - 0xd]
movzx edi, byte [ecx + str.cw]
mov bl, byte [ebx + str.cw]
mov cl, byte [edx + str.cw]
movzx edx, byte [ebp - 0xe]
mov byte [ebp - 0xe], bl
mov ebx, esi
mov dl, byte [edx + str.cw]
shr ebx, 3
mov byte [ebp - 0xd], dl
mov edx, edi
xor dl, byte [ebx + 0x62416298]
mov ebx, edx
jmp 0x6240c4ed
cmp edi, 4
jne 0x6240c4ed
movzx edx, byte [ebp - 0xd]
movzx edi, byte [ebp - 0xe]
mov bl, byte [ebx + str.cw]
mov cl, byte [ecx + str.cw]
mov dl, byte [edx + str.cw]
mov byte [ebp - 0xd], dl
mov dl, byte [edi + str.cw]
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xd]
xor dl, byte [eax + 2]
inc esi
add eax, 4
xor bl, byte [eax - 4]
xor cl, byte [eax - 3]
mov byte [eax + 0x1e], dl
mov dl, byte [ebp - 0xe]
xor dl, byte [eax - 1]
mov byte [eax + 0x1c], bl
mov byte [eax + 0x1d], cl
mov byte [eax + 0x1f], dl
cmp esi, 0x3c
jne 0x6240c46f
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6240c934
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x6240c95f
cmp dword [ebp + 0xc], 0
jne 0x6240c966
xor eax, eax
jmp 0x6240ca3e
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov edx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add edx, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [edx + 0x1c]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
je 0x6240c95f
lea eax, [ebx + ecx]
mov dword [ebp - 0x40], edx
mov edi, dword [eax + esi*4]
mov dword [esp + 8], 1
mov dword [esp + 4], 0
add edi, ebx
mov dword [ebp - 0x3c], ecx
mov dword [esp], edi
call fcn.6240aba8
cmp eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
jne 0x6240ca38
mov eax, dword [ebp - 0x34]
add esi, esi
add esi, ebx
movzx eax, word [esi + eax]
mov esi, dword [ebp - 0x30]
lea eax, [ebx + eax*4]
mov ecx, dword [eax + esi]
add ecx, ebx
mov dword [ebp - 0x24], ecx
cmp ecx, edx
jae 0x6240c9e5
mov eax, dword [ebp - 0x24]
jmp 0x6240ca3e
mov eax, dword [ebp - 0x2c]
add eax, ebx
add eax, edx
cmp ecx, eax
jae 0x6240c9e0
mov dword [esp], edi
call fcn.62411820
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x20], ax
inc eax
mov word [ebp - 0x1e], ax
mov eax, dword [0x62415418]
test eax, eax
je 0x6240c95f
lea edx, [ebp - 0x24]
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], ebx
call eax
sub esp, 0x10
test eax, eax
jns 0x6240c9e0
jmp 0x6240c95f
inc esi
jmp 0x6240c98d
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x62410cf8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
add ecx, dword [ecx + 0x3c]
movzx eax, word [ecx + 0x14]
lea eax, [ecx + eax + 0x18]
cmp dword [eax + 0x14], edx
ja 0x62410d3e
movzx ecx, word [ecx + 6]
imul ecx, ecx, 0x28
add ecx, eax
cmp eax, ecx
je 0x62410d3c
mov ebx, dword [eax + 0xc]
cmp edx, ebx
jb 0x62410d37
mov esi, dword [eax + 0x10]
add esi, ebx
cmp esi, edx
jbe 0x62410d37
add edx, dword [eax + 0x14]
sub edx, ebx
jmp 0x62410d3e
add eax, 0x28
jmp 0x62410d1c
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop ebp
ret
Function at 0x69b100
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c8000]
push edi
or ebp, 0xffffffff
jmp 0x69b122
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x69b129
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69b118
mov eax, 1
add ebx, ebx
jne 0x69b13b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x69b14c
jne 0x69b16b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69b16b
dec eax
add ebx, ebx
jne 0x69b158
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x69b130
add ebx, ebx
jne 0x69b167
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x69b1bd
xor ecx, ecx
sub eax, 3
jb 0x69b183
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x69b1f2
sar eax, 1
mov ebp, eax
jmp 0x69b18e
add ebx, ebx
jne 0x69b18e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69b15c
inc ecx
add ebx, ebx
jne 0x69b19c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69b15c
add ebx, ebx
jne 0x69b1a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x69b19e
jne 0x69b1ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x69b19e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x69b1dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x69b1ce
jmp 0x69b11e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x69b1dc
add edi, ecx
jmp 0x69b11e
pop esi
mov edi, esi
mov ecx, 0x5fe6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x69b1fa
cmp byte [edi], 0x24
jne 0x69b1fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x69b1ff
lea edi, [esi + 0x298000]
mov eax, dword [edi]
or eax, eax
je 0x69b277
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2b6aa8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2b6c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x69b22c
mov ecx, edi
jns 0x69b25b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2b6c2c]
or eax, eax
je 0x69b271
mov dword [ebx], eax
add ebx, 4
jmp 0x69b249
call dword [esi + 0x2b6c28]
mov ebp, dword [esi + 0x2b6c30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x69b2ab
sub esp, 0xffffff80
jmp 0x4c4a71
Function at 0x4053bb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
lea ecx, [ebp - 0xc]
call fcn.004014eb
lea ecx, [ebp - 0x18]
call fcn.004014eb
push 0x3c
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x54]
push edi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 0x10]
xor ebx, ebx
inc ebx
add esp, 0xc
test byte [ebp + 0xc], bl
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x50], 0x740
mov dword [ebp - 0x38], ebx
je 0x40540c
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x50], 0x8740
test byte [ebp + 0xc], 2
je 0x405419
mov dword [ebp - 0x48], str.runas
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.00404ea8
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00401403
cmp dword [ebp - 8], edi
jne 0x40544e
push dword [ebp - 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40548e
test dword [ebp + 0xc], 0x10000
jne 0x40547c
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push esi
jmp 0x405440
xor ebx, ebx
jmp 0x405485

Function at 0x407519
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 0x40], ch
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
lodsb al, byte [esi]
stc
invalid
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
stc
invalid
push ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00406633
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
call dword [edx]

Function at 0x40759f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [edx]
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
invalid
inc dword [esi]

Function at 0x407908
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add byte [edx + 3], ch
push 0
push 1
push SysReAllocString
lea eax, [ebp - 0x334]
push eax
call dword [ebp - 0x3c8]
invalid
invalid
Function at 0x40e820
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x40e82b
xor eax, eax
ret
push esi
mov esi, dword [esp + 8]
movzx eax, byte [esi]
shl eax, 7
sub edx, 1
js 0x40e853
nop dword [eax + eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
imul eax, eax, 0xf4243
xor eax, ecx
sub edx, 1
jns 0x40e840
xor eax, edx
mov ecx, 0xfffffffe
cmp eax, 0xffffffff
pop esi
cmove eax, ecx
ret
Function at 0x4177b0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10054
call fcn.0041a0c0
mov eax, dword [0x44c340]
xor eax, esp
mov dword [esp + 0x10050], eax
mov eax, dword [esp + 0x10058]
xor ecx, ecx
push 0x28
push eax
lea eax, [esp + 8]
mov word [esp + 0x58], cx
push eax
mov word [esp + 0xc], cx
call fcn.004160d0
add esp, 0xc
lea eax, [esp + 0x50]
push 0x10000
push eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x41782d
cmp eax, 0x10000
ja 0x41782d
lea eax, [esp + 0x50]
push eax
call fcn.00428b95
add esp, 4
mov ecx, dword [esp + 0x10050]
xor ecx, esp
call fcn.00419e34
add esp, 0x10054
ret
mov ecx, dword [esp + 0x10050]
xor eax, eax
xor ecx, esp
call fcn.00419e34
add esp, 0x10054
ret
Function at 0x418100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
cmp byte [0x44d617], 0
push esi
jne 0x41815c
push 0xa
push 3
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x44d394], eax
mov esi, dword [eax]
lea ecx, [eax + 4]
mov dword [0x44d394], ecx
mov eax, dword [ecx]
add ecx, 4
push eax
push ecx
push 0
mov dword [0x44d394], ecx
call fcn.004167c0
add esp, 0xc
cmp eax, esi
jne 0x4182c1
mov byte [0x44d617], 1
push ebx
mov ebx, dword [esp + 0x14]
mov ecx, 0x437760
push edi
mov eax, ebx
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x418190
test dl, dl
je 0x41818c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x418190
add eax, 2
add ecx, 2
test dl, dl
jne 0x418170
xor eax, eax
jmp 0x418195
sbb eax, eax
or eax, 1
test eax, eax
je 0x41820d
cmp byte [0x44d616], 1
je 0x41820d
mov esi, dword [sym.imp.python37.dll_PyDict_New]
call esi
mov dword [0x44dc50], eax
call esi
mov dword [0x44dc54], eax
call esi
mov dword [0x44dc58], eax
call esi
mov dword [0x44dc5c], eax
call esi
mov dword [0x44dc60], eax
call esi
mov dword [0x44dc64], eax
call esi
mov dword [0x44dc68], eax
call esi
mov edi, dword [sym.imp.python37.dll_PyLong_FromLong]
mov esi, 0xfffffffb
mov dword [0x44dc6c], eax
nop dword [eax + eax]
push esi
call edi
mov dword [esi*4 + 0x44e814], eax
add esp, 4
inc esi
cmp esi, 0x101
jl 0x4181f0
mov byte [0x44d616], 1
mov esi, dword [0x44d394]
mov eax, ebx
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x418237
test dl, dl
je 0x418233
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x418237
add eax, 2
add ecx, 2
test dl, dl
jne 0x418217
xor edx, edx
jmp 0x41823c
sbb edx, edx
or edx, 1
mov ecx, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418241
sub ecx, edi
add esi, ecx
mov eax, dword [esi + 1]
add esi, 5
test edx, edx
je 0x4182a5
add esi, eax
mov ecx, ebx
mov eax, esi
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x418280
test dl, dl
je 0x41827c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x418280
add ecx, 2
add eax, 2
test dl, dl
jne 0x418260
xor edx, edx
jmp 0x418285
sbb edx, edx
or edx, 1
mov ecx, esi
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418290
sub ecx, edi
add esi, ecx
mov eax, dword [esi + 1]
add esi, 5
test edx, edx
jne 0x418256
movzx eax, word [esi]
push eax
lea eax, [esi + 2]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.00415250
add esp, 0x10
pop edi
pop ebx
pop esi
ret
push str.Error__corrupted_constants_object
call fcn.00426dd0
add esp, 4
call fcn.0041d070
int3
Function at 0x419c40
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x54
mov eax, dword [0x44c340]
xor eax, esp
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x58]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x60]
push 0x28
push eax
lea eax, [esp + 0xc]
mov word [esp + 0xc], cx
push eax
call fcn.004160d0
add esp, 0xc
lea eax, [esp + 4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [esp + 0x54]
pop esi
xor ecx, esp
call fcn.00419e34
add esp, 0x54
ret

Function at 0x419d10
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x58
mov eax, dword [0x44c340]
xor eax, esp
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x5c]
push ebx
mov ebx, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [0x44d5e8]
push ebp
mov ebp, dword [esp + 0x6c]
test eax, eax
jne 0x419d54
push 0x437588
call dword [sym.imp.python37.dll_PyImport_ImportModule]
add esp, 4
mov dword [0x44d5e8], eax
test eax, eax
je 0x419e2e
push esi
push edi
push str.environ
push eax
call dword [sym.imp.python37.dll_PyObject_GetAttrString]
push ebx
mov esi, eax
call dword [sym.imp.python37.dll_PyUnicode_FromString]
add esp, 0xc
mov edi, eax
xor eax, eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x14]
push 0x28
push ebx
push eax
call fcn.004160d0
add esp, 0xc
lea eax, [esp + 0x14]
test ebp, ebp
je 0x419dd5
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0xffffffffffffffff
push ebp
call dword [sym.imp.python37.dll_PyUnicode_FromWideChar]
mov ebx, eax
push ebx
push edi
push esi
call dword [sym.imp.python37.dll_PyObject_SetItem]
add esp, 0x14
test eax, eax
je 0x419dc5
push 1
call dword [sym.imp.python37.dll_PyErr_PrintEx]
push 1
call dword [sym.imp.python37.dll_Py_Exit]
add esp, 8
add dword [ebx], 0xffffffff
jne 0x419df9
mov eax, dword [ebx + 4]
push ebx
mov eax, dword [eax + 0x18]
call eax
jmp 0x419df6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
push esi
call dword [sym.imp.python37.dll_PyObject_DelItem]
add esp, 8
test eax, eax
je 0x419df9
push dword [esp + 0x10]
call fcn.0040c2a0
add esp, 4
add dword [edi], 0xffffffff
jne 0x419e0a
mov eax, dword [edi + 4]
push edi
mov eax, dword [eax + 0x18]
call eax
add esp, 4
add dword [esi], 0xffffffff
jne 0x419e1b
mov eax, dword [esi + 4]
push esi
mov eax, dword [eax + 0x18]
call eax
add esp, 4
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00419e34
add esp, 0x58
ret
call fcn.0041d070
int3

Function at 0x41a7ae
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41a7ed
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41a7ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41a7ed
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41a7ed
cmp dword [ecx + 0x74], 0xe
jbe 0x41a7ed
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret