joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f230
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47b263
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046eeb4
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00474501
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00475a1d
test eax, eax
je 0x43f34c
mov ecx, dword [esp + 0x3c]
call fcn.0047452e
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43f310
push edi
mov ecx, esi
call fcn.00471b8f
mov ecx, esi
call fcn.0043f4f0
cmp dword [esp + 0x38], 1
jne 0x43f345
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00471cca
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x441540
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x441573
push esi
call fcn.0044f8e0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44156c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4415f9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4415e2
mov eax, dword [esi + 8]
test eax, eax
je 0x441597
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4415de
cmp eax, 2
je 0x4415e2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44158a
cmp eax, 3
je 0x4415bd
cmp eax, 1
jne 0x44158a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44158a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44158a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00441620
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x441608
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00441620
add esp, 4
pop esi
ret

Function at 0x441e90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x441eb1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x441eb1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x441eb1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x46fc8f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46fcc7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046dd60
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046dd38
jmp 0x46fcd3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47137d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4713bf
call fcn.00476d07
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4713bf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4713b6
xor eax, eax
jmp 0x4713c7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004713cd
pop edi
pop esi
pop ebx
ret 4
Function at 0x477237
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x477265
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x477283
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047719d
jmp 0x477283
mov eax, dword [esi + 0x14]
test eax, eax
je 0x477283
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047719d
test edi, edi
mov eax, edi
jne 0x47726d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4019b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x94f008]
sub esp, 0x110
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x401b5d
cmp dword [0x94f00c], 0
jne 0x401b49
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.004042c0
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x401a00
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x4190d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x401a10
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x4190d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x401a45
push 0x104
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.004042c0
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401aa4
sub edx, esi
sar edx, 1
je 0x401b5d
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x401ac0
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x104
ja 0x401b5d
xor eax, eax
push ebx
test edx, edx
je 0x401af8
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x401af8
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x401ae1
xor eax, eax
test edx, edx
je 0x401b12
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x401b12
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401b00
xor eax, eax
test edx, edx
je 0x401b2f
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x401b2f
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401b20
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x94f008]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x110
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x110
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x110
ret
Function at 0x402c50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x94f14c]
sub esp, 0x11c
test eax, eax
jne 0x402d4c
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.004042c0
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x402ca0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x419100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x402cb0
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x419104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x402ce5
lea edx, [esp + 0xc]
call fcn.004012e0
pop edi
pop esi
pop ebx
test eax, eax
je 0x402d47
mov eax, dword [eax + 0x18]
test eax, eax
je 0x402d47
mov dword [0x94f14c], eax
add esp, 0x11c
ret
mov eax, dword [0x94f14c]
add esp, 0x11c
ret
Function at 0x403c70
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x94f148
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x403d99
cmp dword fs:[0xc0], eax
je 0x403c9b
mov dword [0x94f144], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x94f02c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x94f030], eax
movzx edx, word [esi + 0xac]
mov dword [0x94f034], edx
mov eax, dword [esi + 0xb0]
mov dword [0x94f038], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x403cfb
push 0x7f
push eax
push 0x94f03c
call fcn.004042f0
mov edx, dword [0x94f034]
add esp, 0xc
jmp 0x403d03
xor eax, eax
mov word [0x94f03c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x94f13c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x94f13e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x94f140], ax
mov ecx, eax
mov byte [0x94f142], 0
cmp byte [0x7ffe0268], 0
je 0x403d4a
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x94f142], bl
cmp ebx, 1
pop ebx
jne 0x403d64
and ecx, 0xffef
mov word [0x94f140], cx
test edx, edx
jne 0x403d99
call fcn.00403c70
cmp dword [0x94f02c], 6
ja 0x403d99
jb 0x403d81
cmp dword [0x94f030], 4
jae 0x403d99
call fcn.00403c70
cmp dword [0x94f02c], 0xa
jae 0x403d99
mov dword [0x94f034], 1
ret
Function at 0x418e92
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x40d0e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x40d140
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x491054]
test esi, esi
jle 0x40d22d
mov edi, dword [0x491058]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x40d174
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40d226
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x40d160
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x40d26a
lea ebx, [esi + esi*2]
mov esi, dword [0x491058]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x491058]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40d24a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40d21f
sub eax, 0x40
and eax, 0xffffffbf
je 0x40d21f
mov eax, dword [esp + 0x20]
add ebx, dword [0x491058]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x40d234
add dword [0x491054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x40d17e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x491058]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x40d730
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x491408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x491400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x40d785
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40d77e
test esi, esi
je 0x40d77e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40d760
mov dword [esp], 0x491408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40d9a0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40d9d8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40d9ce
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40d9da
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40d9c0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40f080
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sym._strlen
mov esi, eax
lea eax, [eax + 0x41]
and eax, 0xfffffff0
call fcn.0040dcb0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
lea edi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [esi + 0x10]
lea edx, [edi + eax]
mov dword [ebp - 0x20], eax
mov dword [edx], 0x61616161
mov dword [edx + 4], 0x61616161
mov dword [edx + 8], 0x61616161
mov dword [edx + 0xc], 0x61616161
mov dword [edx + 0x10], 0x61616161
mov dword [edx + 0x14], 0x61616161
mov dword [edx + 0x18], 0x61616161
mov dword [edx + 0x1c], 0x61616161
mov dword [ebp - 0x24], edx
mov byte [esp + esi + 0x3c], 0
mov byte [esp + esi + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [edi + esi + 0xf], 0x2d
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
mov edx, dword [ebp - 0x24]
je 0x40f16f
int3
mov dword [ebp - 0x24], edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
mov edx, dword [ebp - 0x24]
jne 0x40f213
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov dword [esp], eax
call sym._malloc
mov edx, dword [ebp - 0x24]
mov ebx, eax
mov eax, 0x20
bt ebx, eax
jae 0x40f1aa
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x40f1a2
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x40f210
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call dbg.get_ptr_from_atom
cmp eax, ebx
mov esi, eax
je 0x40f22a
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x1c]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call dbg.get_ptr_from_atom
mov esi, eax
jmp 0x40f1e4
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40f1e4
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x40f1e4
Function at 0x420180
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.0040dcb0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x42026f
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x420313
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x4202a8
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x4202a0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x420310
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x42032a
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x4202e2
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4202e2
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x4202e2
Function at 0x49d42d
Capabilities:
Encode data using xor

Disassembly:
leave
aad 0x72
cld
into
inc esi
pop ecx
insb byte es:[edi], dx
lea ebx, [esi]
lodsd eax, dword [esi]
pop esp
inc ecx
lodsd eax, dword [esi]
cmp esp, dword [eax + 0x54]
test dword [ecx], ebp
sbb al, 0xee
dec ecx
mov ebp, 0xf84ab200
cmp al, 0x2b
insd dword es:[edi], dx
popal
jge 0x49d476
inc eax
mov bl, ch
mov ebx, esp
or al, 0x73
push ds
stosd dword es:[edi], eax
add eax, 0x2f8e45b9
ljmp 0x2482
sahf
mov eax, 0x9fbed66c
pop edi
pop esi
lds edi, [eax]
pushfd
imul ebx, dword [edi + 0x7e9a9db], 0x53fedd4c
shr dword [edi - 0x39], cl
jge 0x49d4a7
add ebp, esp
je 0x49d3f4
scasd eax, dword es:[edi]
into
push esi
lodsb al, byte [esi]
adc eax, 0x7db5000b
lodsb al, byte [esi]
int3
or al, 0x95
movsb byte es:[edi], byte [esi]
jmp 0x49d489
test al, 0xf
xchg edi, eax
dec esp
int 0x6c
jl 0x49d45d
push esp
daa
inc edi
inc ebx
push es
xchg ecx, eax
std
arpl si, bx
jge 0x49d4c0
cmp eax, 0xe6679343
pop es
jl 0x49d473
adc ecx, ebp
jmp 0x49d4f9
imul ebp, dword [ebp + ecx*4 + 0x44], 0x2e
jb 0x49d506
pushfd
mov byte [0x32dde787], al
pop ecx
in eax, dx
pop edx
fdivr qword [edi + eax*8]
dec edx
invalid
invalid
mov bh, 0x7f
adc edi, dword [edi - 0x6b]
sub dl, cl
clc
aas
bnd jge 0x49d531
pop edx
pop ebx
invalid
or cl, dl
pop ebp
push edi
nop
mov al, byte [0xad4a201b]
leave
sahf
invalid

Function at 0x49f83e
Capabilities:
Encode data using xor

Disassembly:
dec ebx
or al, 0x1b
adc ah, bl
aas
mov word [ebp + 0x3d2e09f3], cs
pop eax
les ecx, [eax + edx*4 - 0x37]
fsubr dword [ebp + 0x3de53dbd]
pop eax
push cs
and dl, dh
mov ah, 0x16
scasd eax, dword es:[edi]
lodsd eax, dword [esi]
imul dword [0x6c6ddccd]
mov al, byte [0x4f774686]
invalid
Function at 0x541a19
Capabilities:
Encode data using xor

Disassembly:
rcr cl, cl
dec ebp
jns 0x54198f
xor al, 0xdc
dec esp
cmp al, 0x45
cmp byte [ecx - 0x6ce37799], ch
or al, 0x5a
mov ecx, 0x2578fc3b
js 0x541971
pop edi
dec edx
movsd dword es:[edi], dword [esi]
xchg edx, esp
salc
inc esp
into
sbb cl, 0xff
rcr byte [esi + 0x5819483e], 0xe6
push eax
int1
jno 0x54197b
sbb eax, 0x888ab224
sbb ebp, dword [edx]
add byte [ecx - 0x68], bl
retf
add edx, eax
retf
xchg byte [edi + 0x65fcb1ca], dl
xor byte [0x498], cl
and eax, edi
mov ah, 0xd5
dec ebx
push ds
cwde
wait
mov eax, 0x5425ad43
add byte [edx - 0x78df6fea], ch
xchg esp, eax
and edx, dword [esp + ecx*4 + 0x77]
sub ah, bh
inc ebx
lodsd eax, dword [esi]
and eax, 0x16aa0054
nop
and byte [edi - 0x73abdc6c], al
ja 0x5419c7
cld
out dx, al
jb 0x541935
bound edi, qword [ecx]
invalid
loop 0x54194a
mov dl, 0x99
add byte [esi], cl
mov esp, 0xa2d60653
invalid
mov dword [0x79cdd68d], eax
dec edx
aas
jge 0x541a45
mov ah, 0xc6
cld
sar dword [edi - 0x4a2ce854], 0xc7
pop ebp
jno 0x541a48
pop ds
in eax, dx
jecxz 0x541a25
stosd dword es:[edi], eax
push ds
rcl byte [0x3be1039d], 0x68
sub byte [edx - 0x651d67f0], 0xb
jns 0x541a73
cmp ebp, dword [eax - 0x7e]
stosb byte es:[edi], al
adc byte [eax + 0x790b9ae2], bl
jg 0x541a3d
push 0x9810aa82
loop 0x54198b
or edi, dword [ecx + 0x7f]
dec eax
or dword [edx], eax
mov ah, 0x12
push edx
mov byte [eax], bl
fistp word [ecx - 0x64f2d283]
add eax, 0x9198c3cc
cld
int 0x8a
out dx, eax
and dword [ebx], 0x429922ff
add ah, byte [esi + 0x53]
xor ecx, dword [edi - 0x2da3c6d0]
pop esp
rol byte [edx + 0x13], cl
jg 0x5419af
pop esp
rol byte [edx + 0x13], cl
jg 0x5419af
loope 0x541a59
invalid
push ss
salc
pop ss
arpl word [edx - 0x2c63ece], dx
invalid
push es
jb 0x541a96
add byte [edx + edx*4], 0x94
daa
inc eax
sar dword [ecx - 0x5f], 0x8a
insb byte es:[edi], dx
adc al, 0xac
lodsb al, byte [esi]
mov eax, dword [0xac146c8a]
xchg cl, ah
jecxz 0x5419e9
xchg edi, eax
sbb al, 0x13
bound edi, qword [edi + 0x66c1c65b]
loopne 0x5419ea
loopne 0x5419ea
inc esp
wait
shr edi, 1
mov ch, 0xd2
dec ecx
adc ecx, dword [ecx + 0x36]
pop esp
xor esp, dword [ebx - 0x2d253cc0]
dec esp
movsd dword es:[edi], dword [esi]
in eax, dx
insd dword es:[edi], dx
lodsb al, byte [esi]
jb 0x541a51
fisttp qword [ebp + 0x22]
push cs
dec ebp
and cl, byte [esi]
cld
lodsb al, byte [esi]
sbb byte [edi + 0x43b43c46], 0x56
loop 0x541a02
cmp ebx, eax
insd dword es:[edi], dx
push ecx
inc ebx
cmp eax, 0xf477187b
xchg edx, eax
mov ah, cl
mov esi, 0x8d4b3040
mov esi, dword [ebp + 0x3964a47d]
xchg ecx, eax
movsb byte es:[edi], byte [esi]
and dword [edx - 0x1f], edx
invalid