joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4231d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510698
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
push ebx
push esi
lea eax, [ebp - 0x2c]
mov word [ebp - 0x29], 0x7061
push eax
xor bl, bl
mov word [ebp - 0x26], 0x3233
mov word [ebp - 0x2c], 0x6441
mov byte [ebp - 0x27], 0x69
mov dword [ebp - 0x23], 0x6c6c64
mov byte [ebp - 0x2a], 0x76
mov byte [ebp - 0x24], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4233dc
push edi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3b], 0x73557465
push eax
push esi
mov word [ebp - 0x37], 0x7265
mov dword [ebp - 0x34], 0x41656d61
mov byte [ebp - 0x3c], 0x47
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x35], 0x4e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4233d4
lea ecx, [ebp - 0x48]
call fcn.00424f60
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x4c], 0x100
push eax
call edi
lea eax, [ebp - 0x1c]
mov word [ebp - 0x19], 0x6572
push eax
lea eax, [ebp - 0x14c]
mov word [ebp - 0x1c], 0x7563
push eax
mov dword [ebp - 0x16], 0x65737574
mov word [ebp - 0x12], 0x72
mov byte [ebp - 0x17], 0x6e
mov byte [ebp - 0x1a], 0x72
call fcn.00424950
add esp, 8
movzx ecx, bl
test eax, eax
mov edi, 1
cmove ecx, edi
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x48]
push 0xd
call fcn.004251a0
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00424950
mov ecx, dword [ebp - 0x10]
add esp, 8
movzx ecx, cl
test eax, eax
mov ebx, edi
cmovne ebx, ecx
lea ecx, [ebp - 0x48]
push 0xe
call fcn.004251a0
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00424950
add esp, 8
movzx ebx, bl
test eax, eax
lea ecx, [ebp - 0x48]
cmove ebx, edi
push 0xf
call fcn.004251a0
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00424950
add esp, 8
movzx ecx, bl
test eax, eax
mov edx, edi
cmovne edx, ecx
lea ecx, [ebp - 0x48]
push 0x10
mov dword [ebp - 0x10], edx
call fcn.004251a0
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00424950
mov ecx, dword [ebp - 0x10]
add esp, 8
movzx ebx, cl
test eax, eax
lea ecx, [ebp - 0x48]
cmove ebx, edi
push 0x11
call fcn.004251a0
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00424950
add esp, 8
movzx ecx, bl
test eax, eax
mov edx, edi
cmovne edx, ecx
lea ecx, [ebp - 0x48]
push 0x12
mov dword [ebp - 0x10], edx
call fcn.004251a0
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00424950
mov ecx, dword [ebp - 0x10]
add esp, 8
movzx ebx, cl
test eax, eax
lea ecx, [ebp - 0x48]
cmove ebx, edi
push 0x13
call fcn.004251a0
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00424950
add esp, 8
movzx ecx, bl
test eax, eax
mov ebx, edi
cmovne ebx, ecx
lea ecx, [ebp - 0x48]
call fcn.00424fe0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x424380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
lea eax, [ebp - 0x28]
mov word [ebp - 0x28], 0x6441
push eax
mov dword [ebp - 0x1f], 0x6c6c64
mov dword [ebp - 0x25], 0x33697061
mov word [ebp - 0x21], 0x2e32
mov byte [ebp - 0x26], 0x76
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
xor ebx, ebx
xor esi, esi
test edi, edi
je 0x42445a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x38]
push eax
push edi
mov word [ebp - 0x34], 0x6570
mov word [ebp - 0x2c], 0x41
mov dword [ebp - 0x31], 0x4579654b
mov dword [ebp - 0x38], 0x4f676552
mov byte [ebp - 0x32], 0x6e
mov byte [ebp - 0x2d], 0x78
call esi
mov ebx, eax
mov dword [ebp - 0x44], 0x756c6156
lea eax, [ebp - 0x4c]
mov word [ebp - 0x3d], 0x41
push eax
push edi
mov word [ebp - 0x40], 0x4565
mov word [ebp - 0x4a], 0x5167
mov word [ebp - 0x47], 0x7265
mov word [ebp - 0x4c], 0x6552
mov byte [ebp - 0x45], 0x79
mov byte [ebp - 0x3e], 0x78
mov byte [ebp - 0x48], 0x75
call esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push edi
mov dword [ebp - 0x10], 0x79654b
mov word [ebp - 0x15], 0x6c43
mov word [ebp - 0x12], 0x6573
mov word [ebp - 0x18], 0x6552
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x16], 0x67
call esi
mov esi, dword [ebp - 8]
mov edi, eax
jmp 0x42445c
xor edi, edi
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push dword [ebp + 8]
push 0x80000002
call ebx
test eax, eax
jne 0x424496
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x190
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x424580
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54f118
push 0x442a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x19]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4246c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5107a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
lea eax, [ebp - 0x18]
mov word [ebp - 0x31], 0x656e
push eax
lea eax, [ebp - 0x34]
mov word [ebp - 0x2a], 0x6c6c
push eax
mov dword [ebp - 0x2f], 0x2e32336c
mov word [ebp - 0x34], 0x656b
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x10], 0x41656c
mov dword [ebp - 0x14], 0x69466574
mov dword [ebp - 0x18], 0x61657243
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x424742
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
lea ecx, [ebp - 0x24]
call fcn.00424f60
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push 5
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.004251a0
push eax
call esi
cmp eax, 0xffffffff
lea ecx, [ebp - 0x24]
setne bl
call fcn.00424fe0
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x482130
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00481d35

Function at 0x48213b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00481eb6

Function at 0x48ac4b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048a425

Function at 0x48ac56
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048a660

Function at 0x48b807
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048b5fb
Function at 0x497e80
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0x5c
mov esi, ecx
push 0
push esi
call fcn.00443110
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret
Function at 0x4a1461
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x556c8c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2c], 0
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x20], 0x51
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x20], 0x75
xor eax, eax
inc eax
imul eax, eax, 0x17
mov byte [ebp + eax - 0x20], 0x63
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x20], 0x6d
xor eax, eax
inc eax
imul eax, eax, 0x16
mov byte [ebp + eax - 0x20], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0x14
mov byte [ebp + eax - 0x20], 0x75
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x20], 0x6e
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x20], 0x61
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x20], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x20], 0x63
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x20], 0x71
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x20], 0x79
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x20], 0x66
xor eax, eax
inc eax
imul eax, eax, 0x15
mov byte [ebp + eax - 0x20], 0x65
xor eax, eax
inc eax
imul eax, eax, 0x19
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1a
jae 0x4a1561
jmp 0x4a1566
call fcn.004270d4
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x20], 0
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x20], 0x50
xor eax, eax
inc eax
imul eax, eax, 0x18
mov byte [ebp + eax - 0x20], 0x79
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x20], 0x6f
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x20], 0x46
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x20], 0x72
lea eax, [ebp - 0x20]
push eax
call fcn.004a1710
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4a15c7
push dword [ebp + 8]
call dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426fa0
mov esp, ebp
pop ebp
ret
Function at 0x4a15d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x556c8c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x18], 0x74
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x18], 0x69
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x18], 0x47
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x18], 0x41
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x18], 0x6d
xor eax, eax
inc eax
imul eax, eax, 0x13
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x14
jae 0x4a1634
jmp 0x4a1639
call fcn.004270d4
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x18], 0
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x18], 0x44
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x18], 0x6f
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x18], 0x53
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x18], 0x74
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x18], 0x74
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x18], 0x79
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x18], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x18], 0x63
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x18], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x18], 0x65
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x18], 0x79
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x18], 0x73
lea eax, [ebp - 0x18]
push eax
call fcn.004a1710
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4a16ff
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426fa0
mov esp, ebp
pop ebp
ret
Function at 0x4a1710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x556c8c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x6c
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x6c
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x33
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x6c
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x32
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x4b
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x2e
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x64
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x6e
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xd
jae 0x4a17b4
jmp 0x4a17b9
call fcn.004270d4
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x14], 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426fa0
mov esp, ebp
pop ebp
ret

Function at 0x4a17d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x556c8c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0x276b
call fcn.004a19a1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4a18a9
xor eax, eax
inc eax
imul eax, eax, 0xa
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xb
jae 0x4a1813
jmp 0x4a1818
call fcn.004270d4
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x10], 0
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x10], 0x53
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x10], 0x57
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x10], 0x43
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x10], 0x6e
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x10], 0x41
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x10], 0x75
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x10], 0x70
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x10], 0x61
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x10], 0x65
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4a18a9
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426fa0
mov esp, ebp
pop ebp
ret
Function at 0x4a19a1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x556c8c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x14], 0
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x10], 0x5f
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x10], 0x32
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x10], 0x32
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x10], 0x2e
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x10], 0x73
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x10], 0x6c
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x10], 0x33
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x10], 0x57
xor eax, eax
inc eax
imul eax, eax, 0xa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb
jae 0x4a1a28
jmp 0x4a1a2d
call fcn.004270d4
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x10], 0
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x10], 0x64
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4a1a60
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426fa0
mov esp, ebp
pop ebp
ret
Function at 0x4a55fa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x556c8c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
call fcn.004a5bf5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4a56f3
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x76
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x14], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0xe
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xf
jae 0x4a565d
jmp 0x4a5662
call fcn.004270d4
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x14], 0
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x61
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x45
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x72
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x14], 0x74
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x74
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x43
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x41
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x53
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x57
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4a56f3
call dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426fa0
mov esp, ebp
pop ebp
ret
Function at 0x4a5704
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x556c8c]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x2c], 0xffffffff
call fcn.004a5bf5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4a5848
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x53
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x1c], 0x4e
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x1c], 0x6f
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x1c], 0x74
xor eax, eax
inc eax
shl eax, 4
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x1c], 0x6b
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x1c], 0x77
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x1c], 0x45
xor eax, eax
inc eax
imul eax, eax, 0x11
mov byte [ebp + eax - 0x1c], 0x6e
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x15
jae 0x4a57b4
jmp 0x4a57b9
call fcn.004270d4
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x1c], 0
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c], 0x45
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x1c], 0x6d
xor eax, eax
inc eax
imul eax, eax, 0x13
mov byte [ebp + eax - 0x1c], 0x73
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x1c], 0x57
xor eax, eax
inc eax
imul eax, eax, 0xf
mov byte [ebp + eax - 0x1c], 0x76
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x1c], 0x72
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x41
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x1c], 0x75
xor eax, eax
inc eax
imul eax, eax, 0x12
mov byte [ebp + eax - 0x1c], 0x74
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4a5848
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426fa0
mov esp, ebp
pop ebp
ret
Function at 0x4a5859
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x556c8c]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x24], 0xffffffff
call fcn.004a5bf5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4a595b
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x53
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x14], 0x63
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x57
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x6e
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x53
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x76
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x45
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x6c
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x14], 0x74
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x74
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x41
xor eax, eax
inc eax
imul eax, eax, 0xe
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xf
jae 0x4a5929
jmp 0x4a592e
call fcn.004270d4
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4a595b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426fa0
mov esp, ebp
pop ebp
ret
Function at 0x4a596c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x556c8c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
call fcn.004a5bf5
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4a5a5d
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x41
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x53
xor eax, eax
inc eax
imul eax, eax, 0xd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe
jae 0x4a59c3
jmp 0x4a59c8
call fcn.004270d4
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x14], 0
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x73
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x74
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x52
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x57
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x76
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x45
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x6e
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x14], 0x74
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4a5a5d
push dword [ebp + 8]
call dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426fa0
mov esp, ebp
pop ebp
ret