joyce8/EMBER2024-capa huggingface dataset:
Function at 0xeda580
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
xor ecx, ecx
push esi
mov ebx, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea esi, [ecx + eax + 0x18]
jbe 0xeda630
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
add esi, 0x10
cmp dword [esi], 0
jne 0xeda5e5
mov edx, dword [esp + 0x1c]
mov edi, dword [edx + 0x38]
test edi, edi
jle 0xeda612
mov eax, dword [esi - 4]
push 4
push 0x1000
add eax, ebx
push edi
push eax
call ebp
push edi
push 0
push eax
mov dword [esi - 8], eax
call fcn.00ed97d0
add esp, 0xc
jmp 0xeda612
mov edx, dword [esi - 4]
mov ecx, dword [esi]
push 4
push 0x1000
add edx, ebx
push ecx
push edx
call ebp
mov ecx, dword [esi + 4]
mov edi, eax
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x1c]
add ecx, eax
push ecx
push edi
call fcn.00ed97b0
add esp, 0xc
mov dword [esi - 8], edi
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add esi, 0x28
mov ecx, dword [edx]
xor edx, edx
mov dword [esp + 0x10], eax
mov dx, word [ecx + 6]
cmp eax, edx
jl 0xeda5b4
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret
Function at 0xeda640
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
xor ecx, ecx
mov byte [ebp - 0x1c], 0x47
mov byte [ebp - 0x1b], 0x4b
mov eax, dword [eax]
mov byte [ebp - 0x1a], 0x41
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x20
mov byte [ebp - 0x17], 7
mov byte [ebp - 0x16], 0x1b
mov byte [ebp - 0x15], 0xd8
mov byte [ebp - 0x14], 0xeb
mov byte [ebp - 0x13], 0xc5
mov byte [ebp - 0x12], 0xcf
mov byte [ebp - 0x11], 0xa9
mov byte [ebp - 0x10], 0xbe
mov byte [ebp - 0xf], 0x9a
mov byte [ebp - 0xe], 0xff
mov byte [ebp - 0xd], 0
mov cx, word [eax + 0x14]
push ebx
push esi
lea edx, [ecx + eax + 0x18]
push edi
mov dword [ebp - 8], edx
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
popal
xor ecx, ecx
mov al, cl
mov dl, 0x11
inc al
mov bl, byte [ebp + ecx - 0x1c]
imul dl
xor bl, al
mov byte [ebp + ecx - 0x1c], bl
inc ecx
cmp ecx, 0x10
jb 0xeda6b3
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov ebx, dword [edx]
cmp word [ebx + 6], 0
jbe 0xeda78d
mov eax, dword [ebp - 8]
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0xeda72c
mov ecx, dword [edi - 0x14]
mov edx, dword [edi - 0x1c]
push 0x4000
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0xeda770
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov esi, dword [edx*4 + 0xecbf28]
je 0xeda746
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0xeda761
test al, 0x40
je 0xeda758
mov ecx, dword [ebx + 0x20]
jmp 0xeda75f
test al, 0x80
je 0xeda770
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0xeda770
mov ecx, dword [edi - 0x1c]
lea eax, [ebp - 8]
push eax
push esi
push edx
push ecx
call dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
inc eax
mov ebx, dword [edx]
add edi, 0x28
mov dword [ebp - 4], eax
mov cx, word [ebx + 6]
cmp eax, ecx
jl 0xeda6f9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438860
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22000]
push edi
or ebp, 0xffffffff
jmp 0x438882
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x438889
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x438878
mov eax, 1
add ebx, ebx
jne 0x43889b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x438890
jne 0x4388ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x438890
xor ecx, ecx
sub eax, 3
jb 0x4388c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x438932
mov ebp, eax
add ebx, ebx
jne 0x4388cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4388d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4388fc
inc ecx
add ebx, ebx
jne 0x4388e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4388dd
jne 0x4388f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4388dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43891c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43890d
jmp 0x43887e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43891c
add edi, ecx
jmp 0x43887e
pop esi
mov edi, esi
mov ecx, 0xe0e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43893a
cmp byte [edi], 0xa
jne 0x43893a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x43893f
lea edi, [esi + 0x36000]
mov eax, dword [edi]
or eax, eax
je 0x4389b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3820c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x382ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43896c
mov ecx, edi
jns 0x43899b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x382b0]
or eax, eax
je 0x4389b1
mov dword [ebx], eax
add ebx, 4
jmp 0x438989
call dword [esi + 0x382b4]
popal
jmp 0x41be59
Function at 0x6fba2b40
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x60]
mov eax, dword [esi + 0x18]
mov edi, dword [esi + 0x44]
mov ebx, dword [esi + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x268]
cmp edi, 0x270f
mov dword [esp + 0x24], eax
jle 0x6fba2c81
lea ecx, [edi + 0x22]
lea eax, [edi + 0x23]
test cl, 1
cmovne ecx, eax
mov eax, dword [esi + 0x24]
xor ebp, ebp
mov edx, eax
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0x30]
add ecx, edx
test eax, eax
jle 0x6fba2b9e
mov ebp, edi
shl ebp, 5
add ebp, edi
cmp eax, 0x64
jle 0x6fba2cb0
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x3c]
mov dword [esp + 4], edi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, ebx
call fcn.6fba1a70
cmp dword [esp + 0x24], 2
jle 0x6fba2c09
sub ebp, dword [esp + 0x3c]
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], edi
mov dword [esp + 4], str._______d_work___d_block__ratio__5.2f_n
mov dword [esp + 0x2c], ebp
mov dword [esp + 8], ebp
fild dword [esp + 0x2c]
mov dword [esp + 0x2c], edi
fild dword [esp + 0x2c]
fdivp st(1)
fstp qword [esp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov ebp, dword [esp + 0x3c]
test ebp, ebp
js 0x6fba2c52
mov edx, dword [esi + 0x44]
mov dword [esi + 0x1c], 0xffffffff
test edx, edx
jle 0x6fba2c3e
mov edi, dword [ebx]
test edi, edi
je 0x6fba2ccd
xor eax, eax
jmp 0x6fba2c37
mov ecx, dword [ebx + eax*4]
test ecx, ecx
je 0x6fba2ca0
add eax, 1
cmp eax, edx
jne 0x6fba2c30
mov dword [esp], 0x3eb
call sym.cygbz2_1.dll_BZ2_bz__AssertH__fail
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [esp + 0x24], 1
jle 0x6fba2c81
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x35
mov dword [esp + 4], 1
mov dword [esp], str.____too_repetitive__using_fallback_sorting_algorithm_n
mov dword [esp + 0xc], eax
call sub.cygwin1.dll_fwrite
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
mov dword [esp], edi
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x28]
call fcn.6fba1140
jmp 0x6fba2c11
cmp eax, 0xffffffff
mov dword [esi + 0x1c], eax
je 0x6fba2c3e
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [eax - 1]
mov edx, 0x55555556
mov eax, ebp
imul edx
mov eax, ebp
sar eax, 0x1f
sub edx, eax
imul edx, edi
mov ebp, edx
jmp 0x6fba2b9e
mov dword [esi + 0x1c], 0
jmp 0x6fba2c4a
Function at 0x6fba9d23
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x6fba9d5e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x6fba9d45
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x6fba9d56
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x6fba9d60
inc edi
add eax, 0x28
cmp edi, esi
jb 0x6fba9d3b
xor eax, eax
pop edi
pop esi
ret

Function at 0x6fbaa900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x5125b], al
inc dword [eax]
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
Function at 0x6fbaa970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.6fba9cf3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6fba9ca8
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.6fba9ce3
adc al, 0x5c
or ebx, eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x6fbaa9d7
cmp dword [ebp - 0x398], 0
je 0x6fbaaba1
cmp dword [ebp + 0xc], 1
je 0x6fbaaba1
cmp dword [ebp + 0xc], 8
jne 0x6fbaab69
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.6fba9cf3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6fba9ca8
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.6fba9ce3
sbb eax, edi
mov ebp, 0x68b5ff7b
stc
invalid
call fcn.6fba9ce3
outsb dx, byte [esi]
mov ecx, 0xa580f0ed
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.6fba9ce3
cdq
adc dword [0xd0a5808c], ecx
std
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
inc eax
Function at 0x6fbac990
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
test esi, esi
je 0x6fbac9a9
mov dword [esi], 0
test ebx, ebx
je 0x6fbaca20
mov eax, dword [esp + 0x48]
mov dword [ebx + 0x13c4], 0
test eax, eax
je 0x6fbaca44
mov eax, dword [esp + 0x4c]
shr eax, 0x1f
test al, al
jne 0x6fbaca44
cmp byte [ebx + 0x1390], 0
jne 0x6fbaca00
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x6fbaca54
test esi, esi
je 0x6fbac9e9
mov dword [esi], 0
mov dword [ebx + 0x13c4], 0
xor ebp, ebp
add esp, 0x2c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x6fbaca0a
mov dword [esi], 0xffffffff
mov dword [ebx + 0x13c4], 0xffffffff
xor ebp, ebp
add esp, 0x2c
pop ebx
mov eax, ebp
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x6fbaca50
test ebx, ebx
mov dword [esi], 0xfffffffe
je 0x6fbaca50
mov dword [ebx + 0x13c4], 0xfffffffe
xor ebp, ebp
add esp, 0x2c
pop ebx
mov eax, ebp
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x6fbaca2e
jmp 0x6fbaca24
xor ebp, ebp
jmp 0x6fbac9f5
mov eax, dword [esp + 0x4c]
lea edi, [ebx + 0x1394]
mov dword [ebx + 0x13a8], eax
mov eax, dword [esp + 0x48]
mov dword [ebx + 0x13a4], eax
lea eax, [ebx + 4]
mov dword [esp + 0x18], eax
jmp 0x6fbaca97
cmp eax, 4
je 0x6fbacbc3
mov edx, dword [ebx + 0x13a8]
test edx, edx
je 0x6fbacb6b
mov ebp, dword [ebx]
test byte [ebp + 0xc], 0x40
jne 0x6fbacb90
mov eax, dword [ebx + 0x1398]
test eax, eax
jne 0x6fbacb10
mov dword [esp], ebp
call sub.cygwin1.dll_fgetc
cmp eax, 0xffffffff
je 0x6fbacb10
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.cygwin1.dll_ungetc
mov eax, dword [ebx]
mov dword [esp + 8], 0x1388
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.cygwin1.dll_fread
mov edx, dword [ebx]
test byte [edx + 0xc], 0x40
jne 0x6fbacb90
mov dword [ebx + 0x138c], eax
mov dword [ebx + 0x1398], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x1394], eax
lea esi, [esi]
mov dword [esp], edi
call sym.cygbz2_1.dll_BZ2_bzDecompress
mov ebp, eax
and ebp, 0xfffffffb
jne 0x6fbacbb0
test eax, eax
jne 0x6fbaca80
mov ecx, dword [ebx]
mov dword [esp], ecx
mov dword [esp + 0x1c], ecx
call sub.cygwin1.dll_fgetc
cmp eax, 0xffffffff
je 0x6fbacb53
mov ecx, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.cygwin1.dll_ungetc
jmp 0x6fbaca89
mov eax, dword [ebx + 0x1398]
test eax, eax
jne 0x6fbaca89
mov ecx, dword [ebx + 0x13a8]
test ecx, ecx
jne 0x6fbacbe6
test esi, esi
je 0x6fbacb75
mov dword [esi], 0
mov dword [ebx + 0x13c4], 0
mov ebp, dword [esp + 0x4c]
jmp 0x6fbac9f5
test esi, esi
je 0x6fbacb9a
mov dword [esi], 0xfffffffa
mov dword [ebx + 0x13c4], 0xfffffffa
xor ebp, ebp
jmp 0x6fbac9f5
test esi, esi
je 0x6fbacbb6
mov dword [esi], eax
mov dword [ebx + 0x13c4], eax
xor ebp, ebp
jmp 0x6fbac9f5
test esi, esi
je 0x6fbacbcd
mov dword [esi], 4
mov ebp, dword [esp + 0x4c]
mov dword [ebx + 0x13c4], 4
sub ebp, dword [ebx + 0x13a8]
jmp 0x6fbac9f5
test esi, esi
je 0x6fbacbf0
mov dword [esi], 0xfffffff9
mov dword [ebx + 0x13c4], 0xfffffff9
jmp 0x6fbac9f5
Function at 0x100b7ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fcmovb st(0), st(6)
inc ebp
neg dl
mov byte [ebp - 9], 0xbf
call fcn.0100b45d
push eax
push esi
push dword [ebp + 8]
call fcn.0100b412
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0100b45d
push eax
push esi
push dword [ebp + 8]
call fcn.0100b412
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0100b45d
push eax
push esi
push dword [ebp + 8]
call fcn.0100b412
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0100b44d
cmp byte [edi - 0x62775c2d], dl
jl 0x100b8d2
invalid
invalid
Function at 0x100c88a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x100c84d
Function at 0x695cc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4e0015
lea edi, [esi - 0xdf015]
push edi
or ebp, 0xffffffff
jmp 0x695ce2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x695ce9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x695cd8
mov eax, 1
add ebx, ebx
jne 0x695cfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x695d0c
jne 0x695d2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x695d2b
dec eax
add ebx, ebx
jne 0x695d18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x695cf0
add ebx, ebx
jne 0x695d27
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x695d7d
xor ecx, ecx
sub eax, 3
jb 0x695d43
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x695db2
sar eax, 1
mov ebp, eax
jmp 0x695d4e
add ebx, ebx
jne 0x695d4e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x695d1c
inc ecx
add ebx, ebx
jne 0x695d5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x695d1c
add ebx, ebx
jne 0x695d69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x695d5e
jne 0x695d7a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x695d5e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x695d9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x695d8e
jmp 0x695cde
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x695d9c
add edi, ecx
jmp 0x695cde
pop esi
mov edi, esi
mov ecx, 0x6175
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x695dba
cmp byte [edi], 0x1c
jne 0x695dba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x695dbf
lea edi, [esi + 0x292000]
mov eax, dword [edi]
or eax, eax
je 0x695e2e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2955c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x295704]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x695dec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x295708]
or eax, eax
je 0x695e28
mov dword [ebx], eax
add ebx, 4
jmp 0x695e09
call dword [esi + 0x295710]
mov ebp, dword [esi + 0x29570c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x695e62
sub esp, 0xffffff80
jmp 0x4012b0
Function at 0x401000
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x409660
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov al, byte [0x410484]
push esi
push edi
mov byte [esp + 0x14], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 0
push ecx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x14]
lea ecx, [esp + 8]
push edx
mov dword [esp + 0x124], 1
call sub.MFC42.DLL_CString::operator
push 0x5c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReverseFind
inc eax
lea ecx, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x124], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x120], 1
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [esp + 0x128]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.0040923c
mov dword [esp + 0x10], 1
lea ecx, [esp + 8]
mov byte [esp + 0x120], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x118]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret

Function at 0x401100
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x409678
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push 0x5c
push 0x2f
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::Replace_1
push 0x40f048
push 0x40f044
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::Replace
push 0x40f040
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Find_1
mov esi, eax
test esi, esi
jg 0x401179
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
inc esi
lea ecx, [esp + 0x1c]
push esi
push 0x40f048
call sub.MFC42.DLL_CString::Find
mov esi, eax
test esi, esi
jle 0x4011bc
lea eax, [esi + 1]
lea ecx, [esp + 8]
push eax
push ecx
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::Left
mov edx, dword [esp + 8]
push 0
push edx
call edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
jmp 0x401180
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x401230
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4096a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x2808
call fcn.00409000
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
push 0
mov dword [ebp - 4], 0
call fcn.00401430
mov ebx, dword [ebp + 0xc]
push 0x410484
mov ecx, ebx
call sub.MFC42.DLL_CString::operator
mov ecx, esi
call fcn.004013f0
push 0
push 0
push 0
push 0
push str.myie
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 4], eax
jne 0x4012c0
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 0xc9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0
push 0x80000000
push 0
push 0
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
test eax, eax
mov dword [esi + 8], eax
jne 0x401304
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 0xca
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dl, byte [0x410484]
mov ecx, 0xa00
xor eax, eax
lea edi, [ebp - 0x2817]
mov byte [ebp - 0x2818], dl
mov byte [ebp - 4], 1
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
cmp dword [esi + 0xc], 1
je 0x4013b5
mov edx, dword [esi + 8]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2818]
push 0x2800
push ecx
push edx
call edi
test eax, eax
je 0x4013c3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4013b5
mov byte [ebp + eax - 0x2818], 0
lea eax, [ebp - 0x2818]
push eax
lea ecx, [ebp + 0xc]
push ebx
push ecx
call sub.MFC42.DLL_operator
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
jmp 0x40132a
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004013f0
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8