joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0e12
Capabilities:
Encode data using base64

Disassembly:
push 0x3c
mov eax, 0x5399b4
call fcn.004e49d2
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp + 8]
xor edi, edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], edi
call fcn.0041482e
mov dword [ebp - 4], 1
jmp 0x4b0e4b
push 0x3d
lea ecx, [ebp - 0x28]
call fcn.004308ed
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x40], ebx
test bl, 3
jne 0x4b0e41
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
imul eax, ebx, 3
mov dword [ebp - 0x44], 1
shr eax, 2
test eax, eax
je 0x4b0e77
push eax
mov ecx, esi
call fcn.0049acc3
test ebx, ebx
je 0x4b0fca
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, ebx
cmp byte [eax + edi], 0x7a
jg 0x4b0ead
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, ebx
movsx eax, byte [eax + edi]
movzx ecx, byte [eax + 0x53f490]
mov dword [ebp - 0x30], ecx
jmp 0x4b0eb4
mov dword [ebp - 0x30], 0xff
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, ebx
cmp byte [eax + edi + 1], 0x7a
jg 0x4b0ede
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, ebx
movsx eax, byte [eax + edi + 1]
movzx ecx, byte [eax + 0x53f490]
mov dword [ebp - 0x34], ecx
jmp 0x4b0ee5
mov dword [ebp - 0x34], 0xff
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, ebx
cmp byte [eax + edi + 2], 0x7a
jg 0x4b0f0c
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, ebx
movsx eax, byte [eax + edi + 2]
movzx ecx, byte [eax + 0x53f490]
jmp 0x4b0f11
mov ecx, 0xff
cmp edx, 0x10
mov dword [ebp - 0x38], ecx
lea eax, [ebp - 0x28]
cmovae eax, ebx
cmp byte [eax + edi + 3], 0x7a
jg 0x4b0f3e
cmp edx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, ebx
movsx eax, byte [eax + edi + 3]
movzx eax, byte [eax + 0x53f490]
mov dword [ebp - 0x3c], eax
jmp 0x4b0f45
mov dword [ebp - 0x3c], 0xff
mov al, byte [ebp - 0x34]
shl byte [ebp - 0x30], 2
shr al, 4
and al, 3
shr cl, 2
add al, byte [ebp - 0x30]
and cl, 0xf
mov byte [ebp - 0x2c], al
mov al, byte [ebp - 0x34]
shl al, 4
add cl, al
mov al, byte [ebp - 0x38]
mov byte [ebp - 0x2b], cl
mov cl, byte [ebp - 0x3c]
and cl, 0x3f
shl al, 6
add cl, al
cmp byte [ebp - 0x34], 0xff
mov byte [ebp - 0x2a], cl
je 0x4b0f90
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.004b127e
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
cmp byte [ebp - 0x38], 0xff
je 0x4b0fa7
lea eax, [ebp - 0x2b]
mov ecx, esi
push eax
call fcn.004b127e
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
cmp byte [ebp - 0x3c], 0xff
je 0x4b0fbe
lea eax, [ebp - 0x2a]
mov ecx, esi
push eax
call fcn.004b127e
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
add edi, 4
cmp edi, dword [ebp - 0x40]
jb 0x4b0e85
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00416ab1
mov eax, esi
call fcn.004e497c
ret
Function at 0x4b1640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
shr eax, 4
and edi, 0xf
inc eax
mov dword [ebp - 8], 0
movzx ecx, ax
xor esi, esi
mov dword [ebp - 4], 0x409
mov dword [ebp + 8], ecx
movzx eax, word [ebp + esi*4 - 8]
push eax
push ecx
push 6
push dword [0x5eaa58]
call dword [sym.imp.KERNEL32.DLL_FindResourceExW]
test eax, eax
je 0x4b16c5
push eax
push dword [0x5eaa58]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x4b16c5
push eax
call ebx
test eax, eax
je 0x4b16c5
test edi, edi
jle 0x4b16be
mov edx, edi
nop dword [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + ecx*2]
add eax, 2
sub edx, 1
jne 0x4b16b0
movzx ecx, word [eax]
test ecx, ecx
jne 0x4b16d0
inc esi
cmp esi, 2
jae 0x4b16da
mov ecx, dword [ebp + 8]
jmp 0x4b1671
pop edi
pop esi
add eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x5acd24
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b4a00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5df390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
push ebx
push dword [esi + 0xc]
call fcn.004b1310
mov eax, dword [ebx + 4]
add esp, 0xc
inc eax
cdq
sub eax, edx
sar eax, 1
mov dword [ebx + 8], eax
lea eax, [ebp - 0x18]
push 2
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
je 0x4b4a7f
mov edx, dword [ebx + 8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add eax, edx
mov dword [ebx + 0xc], eax
add ecx, edx
mov eax, dword [ebp - 0xc]
sub eax, edx
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 4]
add eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x18], eax
jmp 0x4b4a9b
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov eax, dword [ebx]
mov esi, ecx
mov edi, dword [ebx + 8]
sub ecx, edi
mov edx, dword [ebx + 0x18]
mov dword [ebx + 0x34], ecx
add edx, edi
mov ecx, dword [ebp - 8]
lea eax, [eax + eax*2]
shl eax, 2
sub ecx, edi
sub esi, eax
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp - 0x14]
sub esi, edi
mov dword [ebx + 0x2c], esi
add eax, edi
sub esi, edi
mov dword [ebx + 0x28], ecx
mov ecx, dword [ebp - 4]
pop edi
mov dword [ebx + 0x24], esi
xor ecx, ebp
pop esi
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], edx
pop ebx
call fcn.004e3e0d
mov esp, ebp
pop ebp
ret
Function at 0x4b5cb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x5df390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebx]
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x254], ebx
call fcn.004cdea0
add esp, 4
cmp dword [ebp + 0x14], 0
je 0x4b5d30
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 5
call ebx
movzx esi, al
or esi, 0xffffff00
push 5
shl esi, 8
call ebx
shr eax, 8
movzx edi, al
or edi, esi
push 5
shl edi, 8
call ebx
mov ebx, dword [ebp - 0x254]
shr eax, 0x10
movzx eax, al
or eax, edi
push eax
push dword [ebx]
call fcn.004ce3a0
mov esi, dword [ebp - 0x258]
add esp, 8
lea eax, [ebp - 0x250]
push eax
push esi
call fcn.004b4a00
mov eax, dword [ebp - 0x244]
add esp, 8
mov ecx, dword [ebp - 0x23c]
cmp eax, ecx
jge 0x4b5de3
mov edx, dword [ebp - 0x240]
mov edi, dword [ebp - 0x238]
cmp edx, edi
jge 0x4b5de3
movd xmm0, eax
lea eax, [ebp - 0x204]
cvtdq2ps xmm0, xmm0
push 0x100
push eax
push dword [esi]
movss dword [ebp - 0x214], xmm0
movd xmm0, edx
cvtdq2ps xmm0, xmm0
movss dword [ebp - 0x210], xmm0
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [ebp - 0x20c], xmm0
movd xmm0, edi
cvtdq2ps xmm0, xmm0
movss dword [ebp - 0x208], xmm0
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xff000000
push dword [ebx + 4]
call fcn.004cdd10
push 9
push dword [ebx + 4]
lea eax, [ebp - 0x204]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x214]
push eax
push dword [ebx + 8]
push dword [ebx]
call fcn.004ce8d0
add esp, 0x24
lea eax, [ebp - 0x250]
push eax
push ebx
push esi
call fcn.004b5820
mov ecx, dword [esi + 0x10]
add esp, 0xc
and ecx, 0x3f
cmp ecx, 9
ja case.default.0x4b5e03
jmp dword [ecx*4 + 0x4b5ebc]
lea eax, [ebp - 0x250]
push eax
push ebx
push esi
call fcn.004ba0f0
add esp, 0xc
jmp case.default.0x4b5e03
lea eax, [ebp - 0x250]
push eax
push ebx
push esi
call fcn.004bb610
add esp, 0xc
jmp case.default.0x4b5e03
cmp ecx, 3
je 0x4b5e41
cmp ecx, 5
je 0x4b5e41
xor edx, edx
jmp 0x4b5e46
mov edx, 1
cmp ecx, 4
je 0x4b5e54
cmp ecx, 5
je 0x4b5e54
xor eax, eax
jmp 0x4b5e59
mov eax, 1
lea ecx, [ebp - 0x250]
push ecx
push ebx
push edx
push eax
push esi
call fcn.004b8e70
add esp, 0x14
jmp case.default.0x4b5e03
lea eax, [ebp - 0x250]
push eax
xor eax, eax
cmp ecx, 7
push ebx
sete al
push eax
push esi
call fcn.004b7820
jmp 0x4b5e9e
lea eax, [ebp - 0x250]
push eax
xor eax, eax
cmp ecx, 9
push ebx
sete al
push eax
push esi
call fcn.004b3e50
add esp, 0x10
push dword [ebx]
call fcn.004ce110
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004e3e0d
mov esp, ebp
pop ebp
ret
Function at 0x4b6980
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5df390]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
add eax, dword [edi + 4]
mov cl, byte [edi + 8]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x4b6a96
test eax, eax
je 0x4b6a96
push esi
test cl, cl
jle 0x4b6a0c
push eax
push 0x53f7dc
push ebx
call fcn.004b3320
mov edx, eax
add esp, 0xc
movsx eax, byte [edi + 8]
mov ecx, edx
add eax, edx
cmp edx, eax
jge 0x4b69ef
mov esi, 0x30
nop dword [eax + eax]
mov word [ebx + ecx*2], si
inc ecx
movsx eax, byte [edi + 8]
add eax, edx
cmp ecx, eax
jl 0x4b69e0
movsx eax, byte [edi + 8]
add eax, edx
xor ecx, ecx
pop esi
pop edi
mov word [ebx + eax*2], cx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3e0d
mov esp, ebp
pop ebp
ret
movsx eax, cl
mov esi, 0xa
neg eax
cmp eax, 1
je 0x4b6a2a
dec eax
nop dword [eax]
lea esi, [esi + esi*4]
add esi, esi
sub eax, 1
jne 0x4b6a20
push 4
lea eax, [ebp - 0xc]
push eax
push 0xe
call dword [sym.imp.KERNEL32.DLL_GetThreadLocale]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4b6a56
mov eax, 0x2e
mov dword [ebp - 0x10], 1
mov word [ebp - 0xc], ax
mov eax, dword [ebp + 0xc]
cdq
xor eax, edx
movsx ecx, byte [edi + 8]
sub eax, edx
neg ecx
cdq
idiv esi
lea eax, [ebp - 0xc]
push edx
push ecx
push eax
mov eax, dword [ebp + 0xc]
cdq
idiv esi
push dword [ebp - 0x10]
push eax
push str._d_.s_0.d
push ebx
call fcn.004b3320
add esp, 0x1c
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3e0d
mov esp, ebp
pop ebp
ret
push eax
push 0x53f7dc
push ebx
call fcn.004b3320
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop ebx
call fcn.004e3e0d
mov esp, ebp
pop ebp
ret

Function at 0x4bd820
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 0x13]
and eax, 1
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004b1640
Function at 0x4c35c0
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5df390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edi, eax
mov dword [ebp - 0x68], 0x30
xor eax, eax
mov dword [ebp - 0x1c], edi
xor esi, esi
mov dword [ebp - 0x64], 0xe3
mov dword [ebp - 0x3c], 0xffffffff
cmp ax, word [ebx + 0x22]
jae 0x4c366e
mov edx, 0x1000
nop word [eax + eax]
lea eax, [esi + 0x3e8]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x58], eax
xor ecx, ecx
movsx eax, word [ebx + 0x4c]
cmp esi, eax
mov eax, dword [ebx + 0x1c]
cmove ecx, edx
mov dword [ebp - 0x5c], ecx
movzx ecx, si
add ecx, ecx
mov ecx, dword [eax + ecx*8]
mov dword [ebp - 0x44], ecx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c3640
lea eax, [ebp - 0x68]
sub ecx, edx
push eax
push 1
push esi
sar ecx, 1
push edi
mov dword [ebp - 0x40], ecx
call dword [sym.imp.USER32.dll_InsertMenuItemW]
movzx eax, word [ebx + 0x22]
inc esi
mov edx, 0x1000
cmp esi, eax
jl 0x4c3610
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x1c
push eax
push edi
mov dword [ebp - 0x34], 0x10
call dword [sym.imp.USER32.dll_GetMenuInfo]
or dword [ebp - 0x30], 0x4000000
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.USER32.dll_SetMenuInfo]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0xca
push 0x419
push dword [ebx + 8]
call edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], 0x14
push ecx
push eax
push 0x41d
push dword [ebx + 8]
call edi
push 0
push 0xca
push 0x412
push dword [ebx + 8]
call edi
movzx esi, ax
mov eax, esi
or eax, 2
push eax
push 0xca
push 0x411
push dword [ebx + 8]
call edi
push 2
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x18]
push eax
push dword [ebx]
push dword [ebp - 8]
push dword [ebp - 0xc]
push 8
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_DestroyMenu]
push esi
push 0xca
push 0x411
push dword [ebx + 8]
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3e0d
mov esp, ebp
pop ebp
ret
Function at 0x4d15d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4d15ef
pop edi
pop esi
pop ebp
ret
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x4d1611
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
test eax, eax
jne 0x4d1618
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
push ebx
push eax
call fcn.004d1590
add esp, 8
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x4e71d6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x51ade5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051ac64

Function at 0x51f47d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051f13d
Function at 0x64002970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6401c014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x6401cf28]
push edi
xor edi, edi
test esi, esi
jne 0x64002a70
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x20c]
push str._sdriversetchosts
push edx
call fcn.64004b03
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
lea esi, [ebp - 0x210]
call fcn.64002550
test eax, eax
jne 0x64002ab0
mov esi, dword [ebp - 0x210]
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.64001b20
test eax, eax
jne 0x64002a2b
mov edi, dword [ebp - 0x210]
call fcn.64001930
test eax, eax
je 0x64002a13
mov ecx, dword [0x6401cf28]
mov dword [edi + 0x10], ecx
mov dword [0x6401cf28], edi
jmp 0x64002a1a
mov eax, edi
call fcn.64001a60
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.64001b20
test eax, eax
je 0x640029f3
mov eax, dword [esi + 4]
test eax, eax
je 0x64002a42
push eax
call fcn.64003b3b
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x64002a59
push eax
call fcn.640041a3
add esp, 4
mov dword [esi + 8], 0
push esi
call fcn.64003b3b
mov esi, dword [0x6401cf28]
add esp, 4
test esi, esi
je 0x64002a85
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ecx, esi
call fcn.64001990
test eax, eax
jne 0x64002a99
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x64002a70
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.64003b2c
mov esp, ebp
pop ebp
ret 4
Function at 0x6400fb29
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.6400ebfc
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
test dword [ebx + 0x55fffffc], ebp
lea eax, [ebp - 0x36c]
push eax
call fcn.6400ec2e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6400ebe3
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.6400ec1e
mov dword [eax], eax
cld
jb 0x6400fc83
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.6400ec1e
int 0x3b
mov eax, dword [0xe065801d]
add byte [eax - 0x39ff1e9b], al
inc ebp
loop 0x6400fc61
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.6400ec2e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6400ebe3
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x6400fcca
inc ebp
ljmp 0xc6b2
invalid
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x6400fcea
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x6400fd07
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x104
jge 0x6400fd6e
invalid
invalid
Function at 0x6401091b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.6400ec2e
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.6400eb8f
add esp, 0xc
jmp 0x64010b96
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.6400ec1e
dec ecx
stc
sbb eax, 0x60b5ffa1
cld
invalid
Function at 0x2b9ccf0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1b7f000]
push edi
or ebp, 0xffffffff
jmp 0x2b9cd12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x2b9cd19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2b9cd08
mov eax, 1
add ebx, ebx
jne 0x2b9cd2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x2b9cd3c
jne 0x2b9cd5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2b9cd5b
dec eax
add ebx, ebx
jne 0x2b9cd48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x2b9cd20
add ebx, ebx
jne 0x2b9cd57
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x2b9cdad
xor ecx, ecx
sub eax, 3
jb 0x2b9cd73
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x2b9cde2
sar eax, 1
mov ebp, eax
jmp 0x2b9cd7e
add ebx, ebx
jne 0x2b9cd7e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2b9cd4c
inc ecx
add ebx, ebx
jne 0x2b9cd8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2b9cd4c
add ebx, ebx
jne 0x2b9cd99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x2b9cd8e
jne 0x2b9cdaa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x2b9cd8e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x2b9cdcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x2b9cdbe
jmp 0x2b9cd0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x2b9cdcc
add edi, ecx
jmp 0x2b9cd0e
pop esi
mov edi, esi
mov ecx, 0x88b01
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x2b9cdea
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x2b9cdef
lea edi, [esi + 0x2797000]
mov eax, dword [edi]
or eax, eax
je 0x2b9ce57
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x27b635c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x27b6548]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x2b9ce15
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x27b6550]
or eax, eax
je 0x2b9ce51
mov dword [ebx], eax
add ebx, 4
jmp 0x2b9ce32
call dword [esi + 0x27b654c]
mov ebp, dword [esi + 0x27b6554]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x2b9ce8b
sub esp, 0xffffff80
jmp 0x1a553e0