joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4060a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x10]
push ebx
sub esp, 0x38
mov eax, dword [sym.imp.kernel32.dll_GetStdHandle]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp], 0xfffffff5
mov dword [ebp - 0x14], eax
call eax
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x4060f8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x24], ecx
call ecx
mov edx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x20], edx
call edx
sub esp, 0x20
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
call ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x14], edx
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
mov edx, dword [ebp - 0x20]
call edx
sub esp, 0x20
mov dword [esp], 0xfffffff5
mov ebx, dword [ebp - 0x14]
call ebx
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov edx, dword [ebp - 0x18]
mov dword [esp + 8], edx
mov edi, dword [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 4], edi
call dword [sym.imp.kernel32.dll_WriteFile]
mov dword [ebp + 8], edi
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.ucrtbase.dll_free]
Function at 0x406df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x406e48
cmp byte [esi + ebx - 1], 0xa
je 0x406e1c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x40c124], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x407890
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x10031750
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1002d048]
push esi
push edi
push eax
push 0x1002be71
mov byte [0x1002be70], 0x45
call fcn.10041200
mov edx, dword [0x1002d048]
mov al, 0x2d
mov byte [0x1002be76], al
mov byte [0x1002be77], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x1002be75], cl
mov byte [0x1002be78], cl
mov esi, 0x1002be79
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x1001ba69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x1003179f
mov byte [esi], 0
pop edi
mov eax, 0x1002be70
pop esi
ret
Function at 0x1003a570
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
cmp esi, 0x3f93
add esp, 0
jno 0x1003a580
jl 0x1003a589
lea esi, [esi]
jae 0x1003a586
jge 0x1003a589
mov ebp, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call fcn.10050a00
add esp, 4
cmp eax, 2
jne 0x1003a5f4
shr esp, 0
xor eax, 0
test ebx, edx
jp 0x1003a5ae
jo 0x1003a5a6
lea esp, [esp]
mov esp, esp
jnp 0x1003a5ae
mov eax, 0x2b57468
adc bh, al
add eax, 0x1002a40c
add al, byte [eax]
add byte [eax], al
push 0x1002b574
mov dword [0x1002a40c], 2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add edx, 0
test edi, 0xaf0
jbe 0x1003a5eb
pushf
test esp, 0x3214
popf
xchg ecx, esi
xchg ecx, esi
lea eax, [eax + 0x7a55]
lea eax, [eax - 0x7a55]
ja 0x1003a5eb
mov eax, 0x1b8
add byte [edi + 0x5e], bl
mov eax, 1
pop edi
pop esi
pop ebp
ret
push edi
add edi, 0x5d84
ror edi, 7
pop edi
std
cld
jne 0x1003a608
mov esp, esp
je 0x1003a608
mov esp, 0x5ec0335f
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1003b3d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xf
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10048840
add esp, 0xc
jbe 0x1003b3eb
add edi, 0
jge 0x1003b412
pushf
jb 0x1003b3f4
popf
nop
lea edx, [edx + 0x59d4]
lea edx, [edx - 0x59d4]
lea edx, [edx + 0x226a]
lea edx, [edx - 0x226a]
jl 0x1003b412
mov esp, 0x72b173b0
mov al, 0x73
mov cl, 0x72
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], al
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], cl
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 8], al
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0xc], 0x32
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x46
mov byte [ebp - 7], 0x74
call fcn.1004cd80
test eax, eax
jne 0x1003b45f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.10041ef0
push 0xf
lea edx, [ebp - 0x14]
mov esi, eax
push 0
push edx
mov dword [ebp - 4], esi
call fcn.10048840
add esp, 0xc
test esi, esi
jne 0x1003b48d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
add ebx, 0
test dword [esp], ecx
rol eax, 0xf
rol eax, 0x11
jbe 0x1003b4c4
pushf
lea ecx, [ecx + 0x263]
sub ecx, 0x263
std
cld
jle 0x1003b4ad
xor eax, 0x571f
xor eax, 0x571f
popf
mov esp, esp
xchg ebx, ecx
xchg ebx, ecx
je 0x1003b4c1
ja 0x1003b4c4
sub eax, 0xf0a6e856
invalid
push esi
call fcn.1003a570
add esp, 4
sub edx, 0
mov esi, esi
jne 0x1003b4eb
pushf
jnp 0x1003b4d8
add eax, dword [esp]
sub eax, dword [esp]
xchg ebx, ebx
xchg edi, edi
popf
xchg ebx, edx
xchg ebx, edx
je 0x1003b4eb
add eax, 0x8b0c458b
dec ebp
or byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003bc20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.10048840
add esp, 0xc
std
cld
jnp 0x1003bc3d
lea esi, [esi + 0x107f]
lea esi, [esi - 0x107f]
ja 0x1003bc73
pushf
ror ecx, 0x17
rol ecx, 0x17
xor ecx, dword [esp + 8]
xor ecx, dword [esp + 8]
cmp esi, dword [esp]
popf
jne 0x1003bc62
lea ebx, [ebx + 0x6e0c]
lea ebx, [ebx - 0x6e0c]
lea edi, [edi]
jbe 0x1003bc73
sub eax, 0x45c666b0
invalid
mov al, 0x66
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xd], 0x4d
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x6d
mov byte [ebp - 8], 0x55
mov byte [ebp - 7], 0x6a
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], al
mov byte [ebp - 4], 0
cld
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
xor ebx, 0
jne 0x1003bcbc
ja 0x1003bcb7
xchg edx, edx
je 0x1003bcbc
lcall 0xf545, 0x8af04d8a
mov cl, byte [ebp - 0x10]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 6]
mov dl, byte [ebp - 0xf]
dec cl
dec al
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0xa]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 5]
dec dl
mov byte [ebp - 6], bl
mov bl, byte [ebp - 0xe]
mov byte [ebp - 0xf], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 5], al
mov al, byte [ebp - 8]
dec dl
mov byte [ebp - 0xe], bl
mov bl, byte [ebp - 0xc]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 7]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0xd], cl
mov byte [ebp - 8], al
mov byte [ebp - 0xc], bl
mov byte [ebp - 7], dl
call fcn.1004cd80
test eax, eax
je 0x1003bda4
cmp eax, edi
jge 0x1003bd3e
js 0x1003bd2b
lea esi, [esi + 0x1de7]
lea esi, [esi - 0x1de7]
jo 0x1003bd39
js 0x1003bd3b
jl 0x1003bd3e
mov eax, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.10041ef0
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
mov ebx, eax
call fcn.10048840
add esp, 0xc
test ebx, ebx
je 0x1003bda4
jle 0x1003bd60
or esi, esi
add esp, 0
jne 0x1003bd7e
pushf
lea edx, [edx]
lea edi, [edi + 0x3c65]
lea edi, [edi - 0x3c65]
popf
jmp 0x1003bd7b
je 0x1003bd7e
mov esi, 0xe7ece853
invalid
push ebx
call fcn.1003a570
add esp, 4
std
cld
jo 0x1003bd8b
clc
jl 0x1003bd9e
pushf
cmp esp, 0x47aa
stc
popf
je 0x1003bd9b
jge 0x1003bd9e
or dword [ebx - 0xaff7bb], 0x5b5e5fd3
mov eax, dword [ebp + 8]
push eax
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003d060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10048840
add esp, 0xc
nop
rol ecx, 0x18
rol ecx, 8
shr esp, 0
jae 0x1003d08e
jp 0x1003d087
jmp 0x1003d089
jb 0x1003d08e
add eax, 0x66b10046
mov cl, 0x66
mov al, 0x75
mov byte [ebp - 0x10], 0x7a
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xb], 0x4a
mov byte [ebp - 0xc], 0x6e
mov byte [ebp - 9], 0x67
mov byte [ebp - 0xe], al
mov byte [ebp - 7], 0
mov byte [ebp - 0x12], al
mov byte [ebp - 8], 0x70
mov byte [ebp - 0x11], 0x54
mov byte [ebp - 0xd], cl
mov byte [ebp - 0xa], 0x6f
push ebx
add ebx, 0x3924
ror ebx, 4
pop ebx
ja 0x1003d0d3
cmp edx, dword [esp + 0xc]
jne 0x1003d0f0
pushf
cmp esp, 0x4f0
je 0x1003d0e3
neg ecx
neg ecx
std
cld
popf
jne 0x1003d0ed
je 0x1003d0f0
mov ecx, 0x8af8558a
dec ebp
int1
mov dl, byte [ebp - 8]
mov cl, byte [ebp - 0xf]
mov al, byte [ebp - 0x13]
mov bl, byte [ebp - 0x11]
dec dl
dec cl
mov byte [ebp - 8], dl
mov dl, byte [ebp - 0xd]
dec al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0x10]
dec bl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xe]
dec dl
mov byte [ebp - 0x11], bl
mov bl, byte [ebp - 0xa]
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 0xc]
dec cl
dec al
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0x14]
dec bl
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0xb]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 9]
mov byte [ebp - 0xc], dl
mov dl, byte [ebp - 0x12]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0x14], cl
mov byte [ebp - 0xb], al
mov byte [ebp - 9], bl
mov byte [ebp - 0x12], dl
mov esp, esp
jb 0x1003d15c
lea eax, [eax]
test esp, 0x7939
jp 0x1003d17b
pushf
xchg ebx, ecx
xchg ebx, ecx
or edi, 0
cmp ebx, dword [esp + 4]
popf
lea esp, [esp]
jnp 0x1003d17b
mov eax, 0xfc00e8
add byte [ebp - 0x607bf040], al
add byte [eax], al
add bl, ch
add cl, al
retf 0x7700
call fcn.1004cd80
test eax, eax
je 0x1003d227
jmp 0x1003d18a
ror edx, 0
ja 0x1003d18f
cmp esp, 0x4948
jbe 0x1003d1a6
lea ecx, [ecx + 0x3b8c]
lea ecx, [ecx - 0x3b8c]
ja 0x1003d1a6
mov ebx, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.10041ef0
push 0xe
lea edx, [ebp - 0x14]
mov esi, eax
push 0
push edx
mov dword [ebp - 4], esi
call fcn.10048840
add esp, 0xc
call 0x1003d1ca
lea esp, [esp + 4]
ror edi, 0x19
rol edi, 0x19
ror esp, 0
ja 0x1003d1e8
pushf
add edi, 0
stc
dec ebx
inc ebx
popf
jp 0x1003d1e5
jbe 0x1003d1e8
mov ebx, 0x3b74f685
test esi, esi
je 0x1003d227
js 0x1003d1ee
xchg esi, edx
xchg esi, edx
jp 0x1003d1fc
mov ebx, ebx
xchg ebx, ebx
jnp 0x1003d1fc
ljmp 0xe857:0xfc7d8bbb
mov edi, dword [ebp - 4]
push edi
call fcn.1003a570
add esp, 4
xor esp, 0
jg 0x1003d221
pushf
ror esi, 0
jns 0x1003d214
nop
popf
mov ebx, ebx
xchg esp, esp
lea esp, [esp]
jle 0x1003d221
ljmp 0xd7ff:0x5008458b
mov eax, dword [ebp + 8]
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003dec0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
mov dword [ebp - 0xb], eax
push 0x1002b6d4
mov byte [ebp - 0xc], 0
mov byte [ebp - 7], al
call esi
sidt [ebp - 0xc]
mov eax, dword [ebp - 0xa]
add eax, 8
mov ebx, dword [eax]
add eax, 0x10
mov eax, dword [eax]
and eax, 0xffff
and ebx, 0xffff
sub eax, ebx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1e
jne 0x1003df25
cmp edi, dword [esp]
jnp 0x1003df0e
neg ebx
neg ebx
jp 0x1003df1e
jae 0x1003df16
lea esp, [esp]
js 0x1003df1b
jnp 0x1003df1e
mov ebx, 0x2bf
add bl, ch
sub al, cl
enter 0xffffffffffff8300, 0xfffffffffffffff4
add byte [ebp + 0x110780], cl
add byte [0x1107], ch
mov edi, 2
jmp 0x1003df4f
ror eax, 0
xor esp, 0
lea eax, [eax + 0x1107]
sub eax, 0x1107
stc
jb 0x1003df4a
pushf
test esp, 0x7045
popf
jnp 0x1003df45
mov esp, esp
jae 0x1003df4a
add eax, 0x4bf
add byte [eax - 0x3c], ch
mov dh, 2
adc bh, bh
salc
mov edi, 4
push 0x1002b6c4
call esi
or edx, 0
xor ecx, ebx
xor ecx, ebx
shr esi, 0
jns 0x1003df6f
pushf
neg ebx
neg ebx
popf
jns 0x1003df6c
js 0x1003df6f
jmp 0x6e63a6fe
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ef20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10048840
add esp, 0xc
js 0x1003ef3b
ror esp, 0
lea esi, [esi]
jg 0x1003ef49
jmp 0x1003ef44
jle 0x1003ef49
mov esp, 0x6db15e4d
mov cl, 0x6d
mov al, 0x66
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x54
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 4], cl
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x49
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 7], 0x62
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 6], 0x6f
sub esp, 0
js 0x1003ef98
test dword [esp + 8], edx
jle 0x1003efa8
pushf
stc
popf
mov esi, esi
jg 0x1003efa8
ljmp 0xf155:0x8aec5d8a
mov bl, byte [ebp - 0x14]
mov dl, byte [ebp - 0xf]
mov cl, byte [ebp - 0xa]
mov al, byte [ebp - 5]
dec bl
dec dl
mov byte [ebp - 0x14], bl
mov bl, byte [ebp - 0x13]
dec cl
mov byte [ebp - 0xf], dl
mov dl, byte [ebp - 0xe]
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 9]
mov byte [ebp - 5], al
mov al, byte [ebp - 4]
dec bl
dec dl
mov byte [ebp - 0x13], bl
mov bl, byte [ebp - 0x12]
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xd]
dec al
mov byte [ebp - 9], cl
mov cl, byte [ebp - 8]
mov byte [ebp - 4], al
mov al, byte [ebp - 3]
dec bl
dec dl
mov byte [ebp - 0x12], bl
mov bl, byte [ebp - 0x11]
dec cl
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 0xc]
dec al
mov byte [ebp - 8], cl
mov cl, byte [ebp - 7]
mov byte [ebp - 3], al
mov al, byte [ebp - 0x10]
dec bl
dec dl
dec cl
dec al
mov byte [ebp - 0x11], bl
mov bl, byte [ebp - 0xb]
mov byte [ebp - 0xc], dl
mov byte [ebp - 7], cl
mov byte [ebp - 0x10], al
mov dl, byte [ebp - 6]
dec bl
dec dl
mov byte [ebp - 0xb], bl
mov byte [ebp - 6], dl
lea eax, [eax + 0x5dfc]
sub eax, 0x5dfc
jb 0x1003f050
pushf
lea ebx, [ebx]
popf
lea edx, [edx]
jae 0x1003f050
mov edx, 0xda8be8
add byte [ebp + 0x5f0975c0], al
call 0x1004cae0
test eax, eax
jne 0x1003f062
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
and esi, 0xffffffff
ja 0x1003f07a
pushf
xchg edx, edi
xchg edx, edi
jnp 0x1003f06f
jae 0x1003f071
popf
xchg edx, edi
xchg edx, edi
jbe 0x1003f07a
or dword [ebp + 0x5051ec4d], 0x2e6ce8
add byte [edx + 0x13], ch
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.10041ef0
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov ebx, eax
call fcn.10048840
add esp, 0xc
test ebx, ebx
jne 0x1003f0a5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor esp, 0
or esp, 0
jmp 0x1003f0ad
jg 0x1003f0ba
xchg ecx, eax
xchg ecx, eax
ja 0x1003f0b3
je 0x1003f0b5
jns 0x1003f0b7
jle 0x1003f0ba
ljmp 0xffff:0xb4b0e853
push ebx
call fcn.1003a570
add esp, 4
jns 0x1003f0c5
jnp 0x1003f0c7
add edi, 0x781
sub edi, 0x781
jnp 0x1003f0ee
pushf
dec eax
inc eax
popf
jno 0x1003f0dd
ja 0x1003f0df
lea esi, [esi + 0x5aca]
lea esi, [esi - 0x5aca]
jp 0x1003f0ee
xor eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100412d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.10048840
add esp, 0xc
cmp eax, 0x5005
neg ecx
neg ecx
sub esp, 0
and esp, 0xffffffff
ja 0x10041304
jb 0x100412fc
xchg esp, esp
mov ecx, ecx
jbe 0x10041304
mov ebx, 0xb073b1ce
mov byte gs:[ebp - 3], 0
mov cl, 0x73
mov al, 0x65
mov byte [ebp - 3], 0
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xb], cl
mov byte [ebp - 6], al
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xa], cl
mov byte [ebp - 5], 0x78
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 9], 0x33
mov byte [ebp - 4], 0x74
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 8], 0x32
mov byte [ebp - 0xc], al
mov byte [ebp - 7], 0x4e
shr esp, 0
cmp esp, 0x3927
rol ecx, 0
jbe 0x1004134a
je 0x10041363
mov esi, esi
jns 0x10041350
jg 0x10041352
lea ebx, [ebx + 0x570a]
lea ebx, [ebx - 0x570a]
jne 0x10041363
ljmp 0xba:0x18e88428
call fcn.1004cd80
test eax, eax
jne 0x10041375
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp eax, edi
cmp ecx, 0x458
jb 0x10041388
mov ebx, ebx
jno 0x10041383
xchg edx, edx
jae 0x10041388
sub eax, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.10041ef0
push 0xe
lea edx, [ebp - 0x10]
push 0
push edx
mov edi, eax
call fcn.10048840
add esp, 0xc
test edi, edi
jne 0x100413b3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
not ebx
not ebx
or esp, 0
jl 0x100413cb
xchg edx, esi
xchg edx, esi
lea esp, [esp]
jle 0x100413c5
jge 0x100413c7
jge 0x100413cb
mov ebp, 0x9fe85755
xchg ecx, eax
invalid
push edi
call fcn.1003a570
add esp, 4
ror esp, 0
or esp, 0
jne 0x100413ed
pushf
jp 0x100413e0
cld
shl eax, 0
popf
lea edx, [edx]
jl 0x100413ea
je 0x100413ed
ljmp 0x84d:0x8b0c458b
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10041ef0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x10041fa2
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10041fa2
xchg esp, esp
lea edx, [edx + 0x2cf2]
lea edx, [edx - 0x2cf2]
xor ebx, edx
xor ebx, edx
jne 0x10041f30
pushf
rol edx, 9
ror edx, 9
popf
nop
lea ebx, [ebx]
je 0x10041f30
mov ebx, 0xff81
add dword [eax], eax
cmp edi, 0x10000
jae 0x10041f4b
nop
je 0x10041f42
jge 0x10041f3d
mov ecx, ecx
jne 0x10041f42
mov ebp, 0xc7e85657
push ecx
add byte [eax], al
push edi
push esi
call 0x10047110
jmp 0x10041f73
ja 0x10041f4d
add esp, 0
jo 0x10041f52
jl 0x10041f69
pushf
xchg esp, esp
jbe 0x10041f5a
add esi, dword [esp]
sub esi, dword [esp]
or eax, eax
popf
xchg esp, esp
jge 0x10041f69
jmp 0x670c64f8
mov eax, dword [ebp + 8]
push edi
push eax
call fcn.10048a20
add esp, 8
test eax, eax
je 0x10041fad
cmp ecx, 0x1819
lea esp, [esp]
jno 0x10041f85
ja 0x10041f87
ja 0x10041f9b
pushf
jl 0x10041f8d
add edi, dword [esp]
sub edi, dword [esp]
nop
popf
mov ebx, ebx
jbe 0x10041f9b
mov ebx, 0x5d5b5e5f
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0x1002b724
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x10046dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.10048840
add esp, 0xc
mov edx, edx
jne 0x10046ddd
jl 0x10046de5
lea ebx, [ebx]
jge 0x10046de5
mov eax, 0xc666b03e
inc ebp
in al, dx
push eax
mov al, 0x66
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], al
mov byte [ebp - 0xa], al
mov byte [ebp - 0x13], 0x71
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 9], 0x42
mov byte [ebp - 0x12], al
mov byte [ebp - 0xd], 0x77
mov byte [ebp - 8], 0
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xb], 0x64
test dword [esp + 0xc], eax
ja 0x10046e1e
je 0x10046e34
pushf
jns 0x10046e24
nop
jae 0x10046e27
mov ebx, ebx
popf
xchg esp, esp
jnp 0x10046e2f
jno 0x10046e31
jne 0x10046e34
ljmp 0xf15d:0x8aec458a
mov al, byte [ebp - 0x14]
mov bl, byte [ebp - 0xf]
mov dl, byte [ebp - 0xa]
mov cl, byte [ebp - 0x13]
dec al
dec bl
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0xe]
dec dl
mov byte [ebp - 0xf], bl
mov bl, byte [ebp - 9]
dec cl
mov byte [ebp - 0xa], dl
mov dl, byte [ebp - 0x12]
mov byte [ebp - 0x13], cl
mov cl, byte [ebp - 0xd]
dec al
dec bl
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0x11]
dec dl
mov byte [ebp - 9], bl
mov bl, byte [ebp - 0xc]
dec cl
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 0x10]
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0xb]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0x11], al
mov byte [ebp - 0xc], bl
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xb], cl
call fcn.10046e99