joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4110a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0xd], 0
push 0
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x18]
push edx
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x411143
push 2
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x411114
jmp 0x41112b
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x10]
jae 0x41112b
cmp dword [ebp - 0xc], 0
jne 0x4110f0
mov edx, dword [ebp - 8]
xor eax, eax
cmp edx, dword [ebp + 0x10]
sete al
mov byte [ebp - 0xd], al
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret

Function at 0x411150
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040ef90
movzx eax, al
test eax, eax
je 0x4112c0
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0x10]
jb 0x4112b1
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x214]
cmp eax, dword [edx]
je 0x4112b1
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x214]
mov dword [ecx], edx
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jbe 0x4112b1
cmp dword [ebp - 0x20c], 0x104
jae 0x4112b1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
add esp, 4
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x2710
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x2710
push edx
lea edx, [ebp - 0x208]
push edx
push str._ls_d_d.exe
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
xor ecx, ecx
mov word [ebp - 0x21a], cx
push 0x80
push 1
push 2
mov edx, dword [ebp - 0x214]
push edx
mov eax, dword [ebp - 0x210]
push eax
lea ecx, [ebp - 0x420]
push ecx
call fcn.004110a0
add esp, 0x18
movzx edx, al
test edx, edx
je 0x4112b1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x420]
push eax
call fcn.0040fde0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x4112a4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x420]
push edx
call fcn.00410000
add esp, 4
jmp 0x4112b1
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040efe0
mov esp, ebp
pop ebp
ret
Function at 0x76f990
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x25b000]
mov dword [edi + 0x31b210], 0xb3d8ff0c
push edi
or ebp, 0xffffffff
jmp 0x76f9ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x76f9c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x76f9b0
mov eax, 1
add ebx, ebx
jne 0x76f9d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x76f9e4
jne 0x76fa03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x76fa03
dec eax
add ebx, ebx
jne 0x76f9f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x76f9c8
add ebx, ebx
jne 0x76f9ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x76fa55
xor ecx, ecx
sub eax, 3
jb 0x76fa1b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x76fa8a
sar eax, 1
mov ebp, eax
jmp 0x76fa26
add ebx, ebx
jne 0x76fa26
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x76f9f4
inc ecx
add ebx, ebx
jne 0x76fa34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x76f9f4
add ebx, ebx
jne 0x76fa41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x76fa36
jne 0x76fa52
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x76fa36
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x76fa74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x76fa66
jmp 0x76f9b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x76fa74
add edi, ecx
jmp 0x76f9b6
pop esi
mov edi, esi
mov ecx, 0x11e0e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x76fa92
cmp byte [edi], 0x4a
jne 0x76fa92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x76fa97
lea edi, [esi + 0x36a000]
mov eax, dword [edi]
or eax, eax
je 0x76fb0f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3899dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x389b80]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x76fac4
mov ecx, edi
jns 0x76faf3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x389b84]
or eax, eax
je 0x76fb09
mov dword [ebx], eax
add ebx, 4
jmp 0x76fae1
call dword [esi + 0x389b94]
mov ebp, dword [esi + 0x389b88]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x76fb43
sub esp, 0xffffff80
jmp 0x5998c5
Function at 0x1623058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x16231a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x162307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x162306a
add dl, dl
jne 0x1623089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x16230dc
xor eax, eax
add dl, dl
jne 0x1623096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x162317d
add dl, dl
jne 0x16230a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16230b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16230bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16230c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x16230d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1623075
mov eax, 1
add dl, dl
jne 0x16230ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16230f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x16230e1
sub eax, ebx
mov ebx, 1
jne 0x1623128
mov ecx, 1
add dl, dl
jne 0x162310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1623119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1623105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1623075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x162313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x162314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1623136
cmp eax, 0x7d00
jae 0x162316d
cmp eax, 0x500
jb 0x1623168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1623075
cmp eax, 0x7f
ja 0x1623170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1623075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x162319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1623075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x673fb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f9000]
push edi
jmp 0x673fca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x673fd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x673fc0
mov eax, 1
add ebx, ebx
jne 0x673fe3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x673ff4
jne 0x674013
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x674013
dec eax
add ebx, ebx
jne 0x674000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x673fd8
add ebx, ebx
jne 0x67400f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x674065
xor ecx, ecx
sub eax, 3
jb 0x67402b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x67409a
sar eax, 1
mov ebp, eax
jmp 0x674036
add ebx, ebx
jne 0x674036
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x674004
inc ecx
add ebx, ebx
jne 0x674044
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x674004
add ebx, ebx
jne 0x674051
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x674046
jne 0x674062
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x674046
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x674084
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x674076
jmp 0x673fc6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x674084
add edi, ecx
jmp 0x673fc6
pop esi
mov edi, esi
mov ecx, 0x5c63
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6740a2
cmp byte [edi], 0x16
jne 0x6740a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6740a7
lea edi, [esi + 0x270000]
mov eax, dword [edi]
or eax, eax
je 0x67411f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3040c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3041cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6740d4
mov ecx, edi
jns 0x674103
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3041d0]
or eax, eax
je 0x674119
mov dword [ebx], eax
add ebx, 4
jmp 0x6740f1
call dword [esi + 0x3041e0]
mov ebp, dword [esi + 0x3041d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x674153
sub esp, 0xffffff80
jmp 0x401488
Function at 0x401a40
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x401a91
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x41a9c8
call fcn.00401a00
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402532
mov esp, ebp
pop ebp
ret
push 3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x401ac7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.00401a00
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402532
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x41a7d4
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 1
push 2
push 0x10
push 4
push str.VPWalletService
push str.VPWalletService
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x401b08
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateService_failed_w_err_0x_08lx_n
jmp 0x401b12
push str.VPWalletService
push str._s_is_installed._n
call fcn.00401a00
add esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
test edi, edi
je 0x401b2a
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00402532
mov esp, ebp
pop ebp
ret
Function at 0x402160
Capabilities:
Access the windows event log
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0
push edi
mov dword [ebp - 8], 0
push dword [esi + 4]
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
test edi, edi
je 0x4021c1
mov ecx, dword [esi + 4]
lea eax, [ebp - 0xc]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 4
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], str.CppWindowsService_in_OnStop
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push str.___________________________________________________________________
push 1
call fcn.00401040
push str.VPWallet_Client_in_OnStop
push 1
call fcn.00401040
push str.___________________________________________________________________
push 1
call fcn.00401040
push 0x41ab30
push 1
call fcn.00401040
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x20
xor edi, edi
mov dword [esi + 0x28], 1
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x30]
test eax, eax
je 0x402275
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x402275
push str._PROCESSDIE__OpenProcess___try.
push 3
call fcn.00401040
add esp, 8
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x402260
cmp dword [ebp - 0x10], 0x103
jne 0x40227a
push str._PROCESSDIE__GetExitCodeProcess_____STILL_ACTIVE.
push 3
call fcn.00401040
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
jmp 0x402275
call ebx
push eax
push dword [esi + 0x30]
push str._PROCESSDIE__GetExitCodeProcess_fail___process__d___errcode_:__u
push 3
call fcn.00401040
add esp, 0x10
cmp edi, 5
jl 0x402206
push 0xffffffffffffffff
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40229f
call fcn.00401050
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402532
mov esp, ebp
pop ebp
ret
call ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 0x41c078
push eax
call fcn.00404a68
int3
Function at 0x4023e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x41d004]
xor eax, esp
mov dword [esp + 0x58], eax
cmp dword [ebp + 8], 1
push esi
mov esi, dword [ebp + 0xc]
jle 0x402473
mov ecx, dword [esi + 4]
movzx eax, word [ecx]
cmp eax, 0x2d
je 0x40240e
cmp eax, 0x2f
jne 0x402473
lea eax, [ecx + 2]
push eax
push 0x41b02c
call fcn.00407ad3
add esp, 8
test eax, eax
jne 0x402440
sub esp, 0x10
call fcn.00401a40
add esp, 0x10
xor eax, eax
pop esi
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00402532
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
add eax, 2
push eax
push str.remove
call fcn.00407ad3
add esp, 8
test eax, eax
jne 0x402520
call fcn.00401b40
xor eax, eax
pop esi
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00402532
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._VPWalletService__Parameters:_n
call esi
push str._VPWalletService___install__to_install_the_service._n
call esi
push str._VPWalletService___remove___to_remove_the_service._n
call esi
push 0x40
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00404b60
push ecx
lea ecx, [esp + 0x18]
call fcn.00401cb0
lea eax, [esp + 8]
mov dword [esp + 0x50], 0x4011b0
mov dword [0x41e508], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x4c]
push eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x4024f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Service_failed_to_run_w_err_0x_08lx_n
call fcn.00401a00
add esp, 8
mov eax, dword [esp + 0x34]
mov dword [esp + 8], vtable.CVPWalletService.0
test eax, eax
je 0x402511
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x34], 0
push str.CVPWalletService::CVPWalletService_Call_____Destructor__
push 1
call fcn.00401040
add esp, 8
mov ecx, dword [esp + 0x5c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00402532
mov esp, ebp
pop ebp
ret
Function at 0x40d3db
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [esi + 0x10]
add eax, ebx
cmp dword [ebp + 0xc], eax
jne 0x40d387
call fcn.0040d1c5
push ecx
ficomp word [ebx]
lodsb al, byte [esi]
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jne 0x40d396
mov eax, dword [esi + 0x14]
add dword [ebp - 0x10], 4
inc ebx
dec eax
cmp ebx, eax
jbe 0x40d36c
jmp 0x40d358
mov eax, dword [edi + ebx*4]
shl eax, 6
add eax, dword [ebp + 8]
jmp 0x40d35a
mov bh, 0x47
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.0040d1c5
jl 0x40d38e
sbb ebp, ebp
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x40d41f
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x40d419
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x40d40a
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8

Function at 0x40d52d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
call 0x512932bb
mov byte [ebp - 0x17], bl

Function at 0x40d573
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push dword [ebp + 8]
call fcn.0040d18a
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040d1d5
push eax
push esi
push dword [ebp + 8]
call fcn.0040d18a
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x40d660
Function at 0x40d8f5
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40d89c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40d8ba
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40d918
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40d8ff
dec ebp
sbb byte [ebx], bh
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40d908
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40d912
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40d8f4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40d87e
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x40de9b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xfffffc
je 0x40deb9
cmp dword [ebp - 0x398], 0
je 0x40e083
cmp dword [ebp + 0xc], 1
je 0x40e083
cmp dword [ebp + 0xc], 8
jne 0x40e04b
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
call fcn.0040d1c5
cmc
scasb al, byte es:[edi]
cmp cl, dh
invalid
movsd dword es:[edi], dword [esi]
invalid