joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d2dcc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4d2f06
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xa2c]
mov eax, dword [eax + 0x254]
call fcn.004634c8
test eax, eax
jle 0x4d2eeb
mov eax, dword [ebx + 0xa2c]
call fcn.00465068
call fcn.00462d20
mov esi, dword [ebx + 0x1542c]
mov edx, esi
dec edx
cmp eax, edx
jle 0x4d2ece
cmp esi, 0x64
jge 0x4d2ece
mov dl, 1
mov eax, dword [ebx + 0x64c]
call fcn.00456a7c
mov byte [ebx + 0x14938], 8
push 9
lea edx, [ebp - 8]
mov eax, dword [0x503418]
mov eax, dword [eax]
call fcn.00453e58
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004097fc
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
mov eax, dword [0x506834]
push dword [eax + 0x153f8]
push 0x4d2f1c
push 0x4d2f34
push 0x4d2f44
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040400c
mov eax, dword [ebp - 0xc]
call fcn.00404110
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x503418]
mov eax, dword [eax]
call fcn.00453e58
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409830
mov eax, dword [ebp - 0x10]
call fcn.00404110
push eax
push 0x4d2f50
mov eax, dword [0x503418]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4d2eeb
xor edx, edx
mov eax, dword [ebx + 0xa2c]
call fcn.00464df0
mov eax, dword [ebx + 0xa2c]
call fcn.00465068
call fcn.0046314c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2f0d
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403cf0
ret
Function at 0x4d2f58
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d30b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xa2c]
mov eax, dword [eax + 0x254]
call fcn.004634c8
test eax, eax
jle 0x4d309c
mov eax, dword [ebx + 0xa2c]
call fcn.00465068
call fcn.00462d20
mov edx, dword [ebx + 0x1542c]
dec edx
cmp eax, edx
jle 0x4d305b
cmp byte [ebx + 0x15428], 0xb
jne 0x4d305b
mov dl, 1
mov eax, dword [ebx + 0x64c]
call fcn.00456a7c
mov byte [ebx + 0x14938], 8
push 9
lea edx, [ebp - 8]
mov eax, dword [0x503418]
mov eax, dword [eax]
call fcn.00453e58
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004097fc
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
mov eax, dword [0x506834]
push dword [eax + 0x153f8]
push 0x4d30cc
push 0x4d30e4
push 0x4d30f4
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040400c
mov eax, dword [ebp - 0xc]
call fcn.00404110
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x503418]
mov eax, dword [eax]
call fcn.00453e58
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409830
mov eax, dword [ebp - 0x10]
call fcn.00404110
push eax
push 0x4d3100
mov eax, dword [0x503418]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4d309c
push 1
mov ecx, 0x4d3108
mov edx, 0x4d3110
mov eax, dword [0x503418]
mov eax, dword [eax]
call fcn.00453ae8
dec eax
jne 0x4d309c
mov eax, dword [ebx + 0xa2c]
call fcn.00465068
call fcn.00462d20
mov edx, eax
mov eax, ebx
call fcn.004d312c
mov edx, dword [ebx + 0x14e7c]
mov eax, ebx
call fcn.004cad14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d30be
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403cf0
ret
Function at 0x4e0820
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 9
push 0
push 0
dec ecx
jne 0x4e0829
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404100
mov eax, dword [ebp - 8]
call fcn.00404100
xor eax, eax
push ebp
push 0x4e0a41
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [0x503418]
mov eax, dword [eax]
call fcn.00453e58
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004097fc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
call fcn.00403f98
mov eax, dword [ebp - 0xc]
call fcn.00409718
test al, al
jne 0x4e09ab
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 0x153fc]
call fcn.00403f98
mov eax, dword [ebp - 0xc]
call fcn.00409718
test al, al
jne 0x4e093d
push 5
lea edx, [ebp - 0x1c]
mov eax, dword [0x503418]
mov eax, dword [eax]
call fcn.00453e58
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004097fc
mov eax, dword [ebp - 0x18]
call fcn.00404110
push eax
push dword [ebx + 0x153f8]
push 0x4e0a58
push 0x4e0a70
push 0x4e0a80
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.0040400c
mov eax, dword [ebp - 0x20]
call fcn.00404110
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x503418]
mov eax, dword [eax]
call fcn.00453e58
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00409830
mov eax, dword [ebp - 0x24]
call fcn.00404110
push eax
push 0x4e0a8c
mov eax, ebx
call fcn.0043b538
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4e0a26
push 5
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.004097fc
mov eax, dword [ebp - 0x2c]
call fcn.00404110
push eax
push dword [ebp - 4]
push 0x4e0a9c
push dword [ebp - 8]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.0040400c
mov eax, dword [ebp - 0x30]
call fcn.00404110
push eax
lea edx, [ebp - 0x38]
mov eax, dword [0x503418]
mov eax, dword [eax]
call fcn.00453e58
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.00409830
mov eax, dword [ebp - 0x34]
call fcn.00404110
push eax
push 0x4e0a8c
mov eax, ebx
call fcn.0043b538
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4e0a26
push 5
lea edx, [ebp - 0x40]
mov eax, dword [0x503418]
mov eax, dword [eax]
call fcn.00453e58
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.004097fc
mov eax, dword [ebp - 0x3c]
call fcn.00404110
push eax
push dword [ebp - 4]
push 0x4e0a9c
push dword [ebp - 8]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.0040400c
mov eax, dword [ebp - 0x44]
call fcn.00404110
push eax
lea edx, [ebp - 0x4c]
mov eax, dword [0x503418]
mov eax, dword [eax]
call fcn.00453e58
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00409830
mov eax, dword [ebp - 0x48]
call fcn.00404110
push eax
push 0x4e0a8c
mov eax, ebx
call fcn.0043b538
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0a48
lea eax, [ebp - 0x4c]
mov edx, 0x13
call fcn.00403cf0
ret
Function at 0x4e1144
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4e114c
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e12ec
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x15438], 0
je 0x4e117e
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x15438]
call fcn.00409274
jmp 0x4e11d5
call fcn.004304c0
lea edx, [ebp - 0x10]
call fcn.004300e0
mov eax, dword [ebx + 0x8fc]
call fcn.0042c104
call fcn.004304c0
lea edx, [ebp - 0x14]
call fcn.004300e0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 4]
call fcn.00409274
call fcn.004304c0
mov edx, dword [ebp - 0x10]
call fcn.00430160
mov eax, dword [ebx + 0x8fc]
mov edx, dword [eax]
call dword [edx + 0xb8]
test eax, eax
jne 0x4e11d5
lea eax, [ebp - 4]
call fcn.00403ccc
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00409274
cmp dword [ebp - 0x18], 0
jne 0x4e11f3
lea eax, [ebp - 4]
mov edx, 0x4e1300
call fcn.00403d64
lea eax, [ebp - 8]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404154
lea eax, [ebp - 0xc]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404154
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.004090d8
mov eax, dword [ebp - 0x1c]
mov edx, 0x4e1320
call fcn.0040405c
jne 0x4e125c
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
push 0
mov eax, dword [0x506834]
call fcn.0043b538
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4e12c6
mov eax, dword [ebx + 0x3e4]
cmp byte [eax + 0x2c], 0
jne 0x4e12bc
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.004090d8
mov eax, dword [ebp - 0x20]
mov edx, 0x4e1330
call fcn.0040405c
je 0x4e129c
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004090d8
mov eax, dword [ebp - 0x24]
mov edx, 0x4e1340
call fcn.0040405c
jne 0x4e12bc
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
push 0
mov eax, ebx
call fcn.0043b538
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4e12c6
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004e146c
lea eax, [ebx + 0x15438]
call fcn.00403ccc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e12f3
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00403cf0
ret
Function at 0x4e146c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404100
xor eax, eax
push ebp
push 0x4e15de
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004e1348
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00409830
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004097fc
cmp dword [ebp - 0xc], 0
je 0x4e1579
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004090d8
mov edx, dword [ebp - 0x14]
mov eax, 0x4e15f4
call fcn.00404238
test eax, eax
jg 0x4e14f7
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004090d8
mov edx, dword [ebp - 0x18]
mov eax, 0x4e1604
call fcn.00404238
test eax, eax
jle 0x4e152b
push 3
mov eax, dword [ebp - 0x10]
call fcn.00404110
push eax
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404110
push eax
push 0x4e160c
mov eax, ebx
call fcn.0043b538
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4e15c3
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004e54d4
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov edx, 0x4e161c
call fcn.00403f98
push 3
mov eax, dword [ebp - 0x10]
call fcn.00404110
push eax
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404110
push eax
push 0x4e160c
mov eax, ebx
call fcn.0043b538
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4e15c3
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.004090d8
mov edx, dword [ebp - 0x20]
mov eax, 0x4e15f4
call fcn.00404238
test eax, eax
jne 0x4e15a5
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4e15f4
call fcn.00403f98
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
push 0
mov eax, ebx
call fcn.0043b538
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e15e5
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00403cf0
ret
Function at 0x4e5ae4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404100
xor eax, eax
push ebp
push 0x4e5ce9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
shl eax, 8
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
add eax, edx
cmp eax, 0xc2e8
jge 0x4e5bd3
cmp eax, 0xb7a2
jge 0x4e5b76
cmp eax, 0xb2c1
jge 0x4e5b4b
add eax, 0xffff4f5f
sub eax, 0x24
jb 0x4e5c75
sub eax, 0x1fc
jb 0x4e5c79
jmp 0x4e5cd1
add eax, 0xffff4d3f
sub eax, 0x22d
jb 0x4e5c7d
sub eax, 0x1fc
jb 0x4e5c81
sub eax, 0xb8
jb 0x4e5c85
jmp 0x4e5cd1
cmp eax, 0xbbf7
jge 0x4e5ba8
add eax, 0xffff485e
sub eax, 0x11f
jb 0x4e5c89
sub eax, 0x13d
jb 0x4e5c8d
sub eax, 0x1f9
jb 0x4e5c91
jmp 0x4e5cd1
add eax, 0xffff4409
sub eax, 0x3af
jb 0x4e5c95
sub eax, 0x106
jb 0x4e5c99
sub eax, 0x23c
jb 0x4e5c9d
jmp 0x4e5cd1
cmp eax, 0xc8f6
jge 0x4e5c33
cmp eax, 0xc5be
jge 0x4e5c0a
add eax, 0xffff3d18
sub eax, 0x1db
jb 0x4e5ca1
sub eax, 0xf3
jb 0x4e5ca5
sub eax, 8
jb 0x4e5ca9
jmp 0x4e5cd1
add eax, 0xffff3a42
sub eax, 0x11c
jb 0x4e5cad
sub eax, 0x1e1
jb 0x4e5cb1
sub eax, 0x3b
jb 0x4e5cb5
jmp 0x4e5cd1
cmp eax, 0xcef4
jge 0x4e5c56
add eax, 0xffff370a
sub eax, 0x304
jb 0x4e5cb9
sub eax, 0x1e0
jb 0x4e5cbd
sub eax, 0x11a
jb 0x4e5cc1
jmp 0x4e5cd1
add eax, 0xffff310c
sub eax, 0x295
jb 0x4e5cc5
add eax, 0xffffffd0
sub eax, 0x318
jb 0x4e5cc9
sub eax, 0x329
jb 0x4e5ccd
jmp 0x4e5cd1
mov bl, 0x41
jmp 0x4e5cd3
mov bl, 0x42
jmp 0x4e5cd3
mov bl, 0x43
jmp 0x4e5cd3
mov bl, 0x44
jmp 0x4e5cd3
mov bl, 0x45
jmp 0x4e5cd3
mov bl, 0x46
jmp 0x4e5cd3
mov bl, 0x47
jmp 0x4e5cd3
mov bl, 0x48
jmp 0x4e5cd3
mov bl, 0x4a
jmp 0x4e5cd3
mov bl, 0x4b
jmp 0x4e5cd3
mov bl, 0x4c
jmp 0x4e5cd3
mov bl, 0x4d
jmp 0x4e5cd3
mov bl, 0x4e
jmp 0x4e5cd3
mov bl, 0x4f
jmp 0x4e5cd3
mov bl, 0x50
jmp 0x4e5cd3
mov bl, 0x51
jmp 0x4e5cd3
mov bl, 0x52
jmp 0x4e5cd3
mov bl, 0x53
jmp 0x4e5cd3
mov bl, 0x54
jmp 0x4e5cd3
mov bl, 0x57
jmp 0x4e5cd3
mov bl, 0x58
jmp 0x4e5cd3
mov bl, 0x59
jmp 0x4e5cd3
mov bl, 0x5a
jmp 0x4e5cd3
mov bl, 0x20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5cf0
lea eax, [ebp - 4]
call fcn.00403ccc
ret
Function at 0x4ff0f4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2b8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404100
xor eax, eax
push ebp
push 0x4ff27a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00409718
test al, al
jne 0x4ff1a0
push dword [ebx + 0x153f8]
push dword [ebx + 0x1544c]
push 0x4ff290
lea edx, [ebp - 0x2b8]
mov eax, dword [ebp - 4]
call fcn.00409868
push dword [ebp - 0x2b8]
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040400c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2b4]
call fcn.0040649a
mov edx, 1
lea eax, [ebp - 0x2b4]
call fcn.004069e8
call fcn.00402874
lea eax, [ebp - 0x2b4]
call fcn.00406604
call fcn.00402874
mov dword [ebp - 8], 1
mov eax, dword [ebx + 0x35c]
call fcn.00441494
mov dl, 1
mov eax, dword [0x41ab24]
call fcn.00422df8
mov esi, eax
mov dl, 1
mov eax, dword [0x41ab24]
call fcn.00422df8
mov edi, eax
push pe_nt_image_headers32
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x168]
mov eax, edi
call fcn.004231c8
mov edx, edi
mov eax, dword [ebx + 0x998]
call fcn.00441400
push 0x101
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x168]
mov eax, esi
call fcn.004231c8
mov edx, esi
mov eax, dword [ebx + 0x99c]
call fcn.00441400
mov eax, esi
call fcn.00402f80
mov eax, edi
call fcn.00402f80
cmp dword [ebp - 8], 1
jne 0x4ff259
mov eax, dword [ebp - 4]
call fcn.00409764
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff281
lea eax, [ebp - 0x2b8]
call fcn.00403ccc
lea eax, [ebp - 4]
call fcn.00403ccc
ret

Function at 0x4ff29c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x168], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404100
xor eax, eax
push ebp
push 0x4ff36e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00409718
test al, al
jne 0x4ff312
push dword [esi + 0x153f8]
push dword [esi + 0x1544c]
push 0x4ff384
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 4]
call fcn.00409868
push dword [ebp - 0x168]
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040400c
mov ebx, 1
push 0x400
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404110
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, edi
lea edx, [ebp - 0x54]
mov ecx, 0x50
call fcn.00403efc
dec ebx
jne 0x4ff34d
mov eax, dword [ebp - 4]
call fcn.00409764
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff375
lea eax, [ebp - 0x168]
call fcn.00403ccc
lea eax, [ebp - 4]
call fcn.00403ccc
ret
Function at 0x653c57a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.653c5504
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.653c54b9
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x653c57e2
invalid
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.653c54f4
or cl, cl
push cs
loope 0x653c57c4
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x653d0fa0
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.653d1060
mov eax, dword [0x653e0f40]
mov ebp, dword [esp + 0x10]
cmp eax, 1
jne 0x653d0fc4
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x653e0f3c], 1
mov byte [0x653e0f38], bl
jne 0x653d101e
mov ecx, dword [0x653e24c8]
test ecx, ecx
je 0x653d100c
mov esi, dword [0x653e24c4]
sub esi, 4
cmp esi, ecx
jb 0x653d100c
mov eax, dword [esi]
test eax, eax
je 0x653d1005
call eax
mov ecx, dword [0x653e24c8]
sub esi, 4
cmp esi, ecx
jae 0x653d0ff7
push 0x653dc01c
push 0x653dc014
call fcn.653d1080
add esp, 8
push 0x653dc024
push 0x653dc020
call fcn.653d1080
add esp, 8
test ebx, ebx
je 0x653d103d
call fcn.653d1070
pop esi
pop ebp
pop ebx
ret
push ebp
mov dword [0x653e0f40], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x653d1350
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.653d2250
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x653dd978], eax
je 0x653d13a8
push 0x74
push 1
call fcn.653d4720
mov esi, eax
add esp, 8
test esi, esi
je 0x653d13a8
mov eax, dword [0x653dd978]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x653d13a8
push esi
call fcn.653d13e0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x653d1400
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x653dd978]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x653d146e
push 0x74
push 1
call fcn.653d4720
mov esi, eax
add esp, 8
test esi, esi
je 0x653d1464
mov ecx, dword [0x653dd978]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x653d1464
push esi
call fcn.653d13e0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
push 0x10
call fcn.653d0340
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret

Function at 0x653d1e40
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x653e1174]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x653d1e82
call edi
mov esi, eax
test esi, esi
je 0x653d1e6c
mov eax, 1
jmp 0x653d1e7d
call ebp
mov ebx, eax
test ebx, ebx
je 0x653d1f8f
mov eax, 2
mov dword [0x653e1174], eax
cmp eax, 1
jne 0x653d1f22
test esi, esi
jne 0x653d1e9b
call edi
mov esi, eax
test esi, esi
je 0x653d1f8f
cmp word [esi], 0
mov eax, esi
je 0x653d1eb5
add eax, 2
cmp word [eax], 0
jne 0x653d1ea3
add eax, 2
cmp word [eax], 0
jne 0x653d1ea3
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x653d1f14
push edi
call fcn.653d0b40
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x653d1f14
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x653d1f06
push ebx
call fcn.653d03a0
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x653d1f8f
test ebx, ebx
jne 0x653d1f33
call ebp
mov ebx, eax
test ebx, ebx
je 0x653d1f8f
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x653d1f4b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x653d1f3b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x653d1f3b
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.653d0b40
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x653d1f6d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret