joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50b79f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x55c054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.004fee63
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004fee63
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x50b816
cmp word [ecx], dx
je 0x50b816
mov eax, dword [0x51c1ec]
push edi
dec eax
push eax
push 0x51c0d8
call fcn.0050b73e
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x50b889
cmp word [eax], dx
je 0x50b889
mov eax, dword [edi]
test eax, eax
je 0x50b83a
cmp word [eax], dx
je 0x50b83a
lea eax, [ebp - 0x10]
push eax
call fcn.0050b121
jmp 0x50b843
lea eax, [ebp - 0x10]
push eax
call fcn.0050b1bc
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x50b8b3
mov eax, dword [0x51c0d4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x51bdc8
call fcn.0050b73e
add esp, 0xc
test al, al
je 0x50b8b3
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x50b87e
cmp word [eax], di
je 0x50b87e
lea eax, [ebp - 0x10]
push eax
call fcn.0050b121
pop ecx
jmp 0x50b8b5
lea eax, [ebp - 0x10]
push eax
call fcn.0050b1bc
jmp 0x50b87b
mov eax, dword [edi]
test eax, eax
je 0x50b8a0
cmp word [eax], dx
je 0x50b8a0
lea eax, [ebp - 0x10]
push eax
call fcn.0050b0d6
pop ecx
jmp 0x50b8b3
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x50b97e
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0050b5c3
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x50b97e
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x50b97e
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x50b97e
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x50b90b
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.005000bf
test ebx, ebx
je 0x50b979
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.005000bf
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x50b97e
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x50b97e
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.004ff27c
add esp, 0x10
xor eax, eax
inc eax
jmp 0x50b980
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e7a8e
leave
ret
Function at 0x50fd75
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0050fcf1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x50fee4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x50fee4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x50fe99
jg 0x50fdd1
test eax, eax
je 0x50fe8f
push 1
push 0x1000
call fcn.004ff977
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x50fdf4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x50fe86
push 0x8000
push ebx
call fcn.004fc8af
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x50fe1d
jg 0x50fe18
cmp ecx, 0x1000
jb 0x50fe1d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00502fd0
add esp, 0x10
cmp eax, 0xffffffff
je 0x50fe62
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x50fe18
jl 0x50fe49
test ecx, ecx
jne 0x50fe0a
push dword [ebp - 0xc]
push ebx
call fcn.004fc8af
push esi
call fcn.004ff93d
add esp, 0xc
xor ebx, ebx
jmp 0x50fef2
cmp byte [edi + 0x24], 0
je 0x50fe79
cmp dword [edi + 0x20], 5
jne 0x50fe79
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x50fe84
mov ebx, dword [edi + 0x18]
jmp 0x50fe86
xor ebx, ebx
push esi
call fcn.004ff93d
pop ecx
jmp 0x50fef2
test ecx, ecx
jg 0x50fe5b
jl 0x50fe99
test eax, eax
jae 0x50fe5b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00501be9
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x50feb9
cmp byte [edi + 0x1c], 0
je 0x50fe5b
jmp 0x50feea
push ebx
call fcn.0050978d
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x50fe5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x50fef2
cmp byte [edi + 0x1c], 0
je 0x50feef
mov ebx, dword [edi + 0x18]
jmp 0x50fef2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00501be9
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401a70
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47a14c]
jne 0x401a7a
repz ret
jmp fcn.0040251b

Function at 0x40b00e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47a14c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040408b
and dword [ebp - 0x14], 0
cmp dword [0x47ccf8], 0
mov dword [ebp - 0x18], eax
jne 0x40b0c1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b169
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40b169
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x47ccf8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x47ccfc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x47cd00], eax
call edi
push eax
call esi
mov dword [0x47cd08], eax
test eax, eax
je 0x40b0c1
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x47cd04], eax
mov eax, dword [0x47cd04]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b11a
cmp dword [0x47cd08], ecx
je 0x40b11a
push eax
call esi
push dword [0x47cd08]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b11a
test ebx, ebx
je 0x40b11a
call edi
test eax, eax
je 0x40b111
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b111
test byte [ebp - 8], 1
jne 0x40b11a
or dword [ebp + 0x10], 0x200000
jmp 0x40b14d
mov eax, dword [0x47ccfc]
cmp eax, dword [ebp - 0x18]
je 0x40b14d
push eax
call esi
test eax, eax
je 0x40b14d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b14d
mov eax, dword [0x47cd00]
cmp eax, dword [ebp - 0x18]
je 0x40b14d
push eax
call esi
test eax, eax
je 0x40b14d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47ccf8]
call esi
test eax, eax
je 0x40b169
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b16b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a70
leave
ret
Function at 0x46b2f0
Capabilities:
Get geographical location

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jle 0x46b37e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp dword [esp + 0x18], 0x2d
jne 0x46b33c
push 0
push str.tabukojugacefofehevugijumapo_lezegiyoritatureguhikihubumuw_xaxeharufutogokurulumifadasovac_vubecifuwibugawiculedodov_cezotoburosuhipijavor
call edi
push str.fidodekodinifobuyox
push str.mayuretubayazihexe
push str.fetodidibamonasuyifiluhib
push str.vizuzecizeyasufuhizosusi
call ebx
push 0
call ebp
call fcn.0046b240
mov ecx, dword [esp + 0x14]
xor byte [esi + ecx], al
cmp dword [esp + 0x18], 0xf
jne 0x46b374
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push str.lavenoxatorav
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [esp + 0x18]
jl 0x46b312
pop edi
pop ebp
pop ebx
cmp dword [esp + 0xc], 0x2d
pop esi
jne 0x46b39a
mov dword [0x47da08], 0xa62e7790
mov dword [0x47da0c], 0xffffffff
ret
Function at 0x46b740
Capabilities:
Access the windows event log
Set file attributes

Disassembly:
mov eax, dword [0x47d9fc]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov ebp, 0x1519a5
lea esp, [esp]
mov dword [0x47d664], 0x8e46a7b8
cmp eax, 0x3dc
jne 0x46b78a
push 0
push str.gajaracuvegipozatoxesom
call esi
push str.kimezufiyutodojaxejuweg
push 0
push 0
call edi
mov eax, dword [0x47d9fc]
dec ebp
jne 0x46b760
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
xor esi, esi
mov ebp, 0xec58acac
lea ebx, [ebx]
cmp eax, 0x997
jne 0x46b7b2
push 0
push 0
call edi
mov eax, dword [0x47d9fc]
cmp esi, 0x846373
jne 0x46b7c9
mov eax, dword [0x47bad0]
add eax, 0xa231
mov dword [0x47d9fc], eax
cmp eax, 0x141
jne 0x46b7e0
mov dword [0x47d238], ebp
mov dword [0x47d23c], 0xffffffff
inc esi
cmp esi, 0x123c962
jl 0x46b7a0
call fcn.0046b3e0
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x10
Function at 0x40eb30
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x7c]
push ebx
push esi
push edi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], 0x40
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], eax
mov edx, dword [eax + 0x30]
mov eax, dword [ecx + 0x3c]
lea eax, [edx + eax]
movzx edx, word [eax + 6]
add eax, 0xf8
mov dword [ebp - 0x74], eax
lea eax, [edx - 1]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
jb 0x40ecb5
sub dword [ebp - 0x6c], 1
lea esi, [esi]
add dword [ebp - 0x6c], 1
imul eax, dword [ebp - 0x6c], 0x28
mov edx, dword [ebp - 0x74]
lea esi, [eax + edx]
lea edi, [ebp - 0x4c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x7c]
or edx, eax
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
test dword [ebp - 0x50], 0xffffffff
je 0x40eca9
mov ebx, dword [ebp - 0x28]
mov eax, ebx
and eax, 0x2000000
je 0x40ec0c
push 0x4000
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 8]
jmp 0x40eca9
mov eax, ebx
and eax, 0x20000000
je 0x40ec1e
mov dword [ebp - 0x68], 1
jmp 0x40ec25
mov dword [ebp - 0x68], 0
mov eax, ebx
and eax, 0x40000000
je 0x40ec37
mov dword [ebp - 0x64], 1
jmp 0x40ec3e
mov dword [ebp - 0x64], 0
mov eax, ebx
and eax, 0x80000000
je 0x40ec50
mov dword [ebp - 0x60], 1
jmp 0x40ec57
mov dword [ebp - 0x60], 0
mov eax, ebx
and eax, 0x4000000
je 0x40ec69
mov dword [ebp - 0x5c], 1
jmp 0x40ec70
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x68]
shl eax, 4
lea eax, [ebp + eax - 0x24]
mov edx, dword [ebp - 0x64]
lea ecx, [eax + edx*8]
mov eax, dword [ebp - 0x60]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x5c], 1
jne 0x40ec96
or dword [ebp - 0x54], 0x200
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 4]
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
ja 0x40ebb4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408956
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
call fcn.00408975
add ecx, ebx
or ebx, ebx
xor dword [edi], eax
add ecx, ecx
add edi, 1
cmp edi, edx
jne fcn.00408956
ret

Function at 0x40893e
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop ebx
add esi, 0xfbc8d45d
call fcn.00408968
xor dword [ecx], ebx
and eax, esi
add ecx, 1
cmp ecx, edx
jne fcn.0040893e
sub esi, 0xc497b748
ret
Function at 0x40f360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push dword [ebp + 8]
call fcn.0040f070
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40f399
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52

Function at 0x40f4a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [0xa345c635], al
and al, 0xc6
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.0040f0bb
push eax
push esi
push dword [ebp + 8]
call fcn.0040f070
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
Function at 0x40fcb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.0040f0ab
mov bl, 0xbf
jne 0x40fcfa
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.0040f0bb
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f070
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.0040f0ab
cmp dword [ebx + 0x468866f], esi
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x40fd74
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x40fd9f
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je 0x40ff69
cmp dword [ebp + 0xc], 1
je 0x40ff69
cmp dword [ebp + 0xc], 8
jne 0x40ff31
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
test dword [edx - 7], edx
invalid
call dword [esi]
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.0040f0bb
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f070
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
invalid
Function at 0x411080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x37c], 0
jne 0x41108e
jmp fcn.00410a4d
cmp dword [ebp - 0x37c], 0
je 0x41109c
jmp 0x411151
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x4110f5
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x4110fa
jmp fcn.00410a4d
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x411141
lea eax, [ebp - 0x714]
push eax
call fcn.0040f0bb
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.0040f070
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x41114c
jmp 0x411151
jmp fcn.00410a4d
cmp dword [ebp - 0x37c], 0
jne 0x4111fb
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f287
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x4111e7
lea eax, [ebp - 0x714]
push eax
call fcn.0040f0bb
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.0040f150
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp eax, 0x42
mov eax, ebx
mov eax, ebx
cmp eax, 0xa78ac288
cmp eax, 0x43
mov eax, 0xf8c93991
mov eax, ecx
cmp eax, 0xf6a94344
mov eax, 0x51956134
nop
cmp eax, 0xb05f45d7
nop
mov eax, ebx
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp eax, 0xe242e350
cmp eax, 0xffffffa1
mov eax, ebx
nop
inc eax
nop
cmp eax, 0xffffffb3
inc eax
mov eax, 0xa10c0c99
mov eax, ecx
cmp eax, 0xa8651d4
inc eax
cmp eax, 0xde5fa205
mov eax, ecx
mov eax, ebx
nop
nop
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 0xdd221192
mov eax, ecx
mov eax, 0x3b30249f
inc eax
mov eax, ebx
nop
nop
cmp eax, 0x58
cmp eax, 0xcbb08b4a
mov eax, 0x37986dce
inc eax
mov eax, ebx
mov eax, ecx
cmp eax, 0x9ebbcaaf
inc eax
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
inc eax
mov eax, ecx
cmp eax, 0x73de6c2b
mov eax, ebx
inc eax
mov eax, 0xfb3d0063
nop
mov eax, ebx
mov eax, ecx
cmp eax, 0x1c
cmp eax, 0xffffffd9
inc eax
cmp eax, 0x8f9c3c3a
mov eax, ecx
mov eax, 0xd761cf55
nop
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
mov eax, ebx
cmp eax, 0xa1bb5602
inc eax
cmp eax, 0xffffff84
cmp eax, 0xbe0bf9c5
mov eax, ecx
inc eax
mov eax, ebx
cmp eax, 0xffffffa7
nop
cmp eax, 0x67
inc eax
mov eax, ecx
nop
cmp eax, 0x42796cb6
nop
mov eax, ecx
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
inc eax
cmp eax, 0x6dd8dc80
mov eax, 0x23b20415
cmp eax, 0x95e24b91
mov eax, 0x869bb258
mov eax, ebx
mov eax, 0x7a9d067a
inc eax
cmp eax, 0x92800a95
cmp eax, 0xffffffff
cmp eax, 0xc89ea3af
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001e770
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001e5e6

Function at 0x408901
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x4085d8
pop edi
add ebx, 0x7936bb4a
call fcn.00408929
sub ebx, esi
xor dword [eax], edi
or ebx, esi
inc eax
cmp eax, edx
jne fcn.00408901
and ebx, esi
push ebx
pop esi
ret

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret