joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512a88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
popal
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00512778
aas
sub ebp, dword [ebx + eax*4]
lea eax, [ebp - 0x40]
push eax
call fcn.00512788
push eax
push esi
push dword [ebp + 8]
call fcn.0051273d
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00512778
pushfd
movsd dword es:[edi], dword [esi]
inc esi
inc esi
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00512788
push eax
push esi
push dword [ebp + 8]
call fcn.0051273d
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00512788
push eax
push esi
push dword [ebp + 8]
call fcn.0051273d
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00512788
push eax
push esi
push dword [ebp + 8]
call fcn.0051273d
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00512778
mov eax, dword [0x88b31246]
popfd
jl 0x512bfd
invalid
invalid
Function at 0x513bec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00512778
pop edx
jge 0x513c5f
invalid
test al, 0x8d
test esp, edx
clc
invalid
Function at 0x42e560
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1b000]
push edi
or ebp, 0xffffffff
jmp 0x42e582
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42e589
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42e578
mov eax, 1
add ebx, ebx
jne 0x42e59b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42e590
jne 0x42e5ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42e590
xor ecx, ecx
sub eax, 3
jb 0x42e5c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42e632
mov ebp, eax
add ebx, ebx
jne 0x42e5cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42e5d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42e5fc
inc ecx
add ebx, ebx
jne 0x42e5e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42e5dd
jne 0x42e5f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42e5dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42e61c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42e60d
jmp 0x42e57e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42e61c
add edi, ecx
jmp 0x42e57e
pop esi
mov edi, esi
mov ecx, 0x761
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42e63a
cmp byte [edi], 0xc
jne 0x42e63a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42e63f
lea edi, [esi + 0x2c000]
mov eax, dword [edi]
or eax, eax
je 0x42e6b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x30954]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x30a1c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42e66c
mov ecx, edi
jns 0x42e69b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x30a20]
or eax, eax
je 0x42e6b1
mov dword [ebx], eax
add ebx, 4
jmp 0x42e689
call dword [esi + 0x30a24]
popal
jmp 0x41a05e

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x4a502a65
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + edx*8 + 0x78]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
jmp 0x4a502abd
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x4a502b05
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.4a5029f5
add esp, 8
cmp eax, dword [ebp + 0x10]
inc ebp
adc byte [ebp + 0x17], dh
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
push ebp
call 0x9454e205
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax*4]
invalid

Function at 0x4a502b18
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x18
mov eax, dword fs:[0x18]
add byte [ecx + 0x4d8bf845], cl
clc
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0xc]

Function at 0x4a504cb0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4a5e4008], 0x8088405
inc edx
mov dword [ebx + 0x4a5e4008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x4a509b54
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a509cb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.4a507618
cmp si, word [0x4a5e4a00]
jb 0x4a509bec
cmp si, word [0x4a5e4c00]
ja 0x4a509bec
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x4a509bec
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x4a5e4a00]
jae 0x4a509bc6
mov edi, ebx
dec edi
jmp 0x4a509be7
cmp si, word [ebx*8 + 0x4a5e4a00]
jbe 0x4a509bd6
inc ebx
mov dword [ebp - 8], ebx
jmp 0x4a509be7
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4a5e4a04]
call fcn.4a509a74
jmp 0x4a509bec
cmp edi, dword [ebp - 8]
jae 0x4a509bb0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4a509c9b
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4a509c9b
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.4a5083a4
push dword [ebp - 0x160]
push 0x4a509cd4
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.4a5083a4
push dword [ebp - 0x164]
push 0x4a509ce4
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.4a5083a4
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.4a508570
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a509cc0
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.4a507678
ret

Function at 0x4a509e6c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a509f70
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a5f0b84
call fcn.4a502b48
cmp bx, word [0x4a5f0b9c]
jne 0x4a509eb8
mov eax, esi
mov edx, 0x4a5f0b9e
mov ecx, 0x55
call fcn.4a5083a4
push 0x4a5f0b84
call fcn.4a502b50
jmp 0x4a509f5a
push 0x4a5f0b84
call fcn.4a502b50
mov eax, esi
call fcn.4a507618
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4a509f27
cmp byte [0x4a5f0b80], 0
je 0x4a509eec
mov edx, esi
mov eax, ebx
call fcn.4a509d50
jmp 0x4a509f27
mov edx, esi
mov eax, ebx
call fcn.4a509b54
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x4a509f27
cmp dword [esi], 0
je 0x4a509f10
mov eax, esi
mov edx, 0x4a509f88
call fcn.4a508490
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.4a509b54
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.4a508490
push 0x4a5f0b84
call fcn.4a502b48
mov word [0x4a5f0b9c], bx
mov eax, dword [esi]
call fcn.4a5082f8
mov ecx, eax
mov eax, 0x4a5f0b9e
mov edx, 0xaa
call fcn.4a5099d4
push 0x4a5f0b84
call fcn.4a502b50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a509f77
lea eax, [ebp - 4]
call fcn.4a507618
ret
Function at 0x4a50a6b4
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.4a5076fc
xor eax, eax
push ebp
push 0x4a50a774
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.4a5083a4
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.4a5084e8
mov eax, dword [ebx]
call fcn.4a50a57c
test al, al
jne 0x4a50a751
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.4a5083a4
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.4a5084e8
mov eax, dword [ebx]
call fcn.4a50a57c
test al, al
jne 0x4a50a751
mov eax, ebx
call fcn.4a507618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a50a77b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.4a507678
lea eax, [ebp - 4]
call fcn.4a507618
ret

Function at 0x4a50af10
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x4a51059c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, eax
test ebp, ebp
je 0x4a51063c
test ebp, ebp
setl byte [esp]
mov eax, edi
xor ecx, ecx
mov edx, 0xb
call fcn.4a5080ac
mov esi, 0xb
mov eax, ebp
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
mov ecx, 0xa
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, edi
call fcn.4a507bb8
add bl, 0x30
mov byte [eax + esi - 1], bl
dec esi
test ebp, ebp
jne 0x4a5105c6
cmp byte [esp], 0
je 0x4a51060b
mov eax, edi
call fcn.4a507bb8
mov byte [eax + esi - 1], 0x2d
dec esi
test esi, esi
jle 0x4a510648
mov eax, edi
call fcn.4a507bb8
push eax
mov eax, edi
call fcn.4a507bb8
add eax, esi
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
pop edx
call fcn.4a504a94
mov edx, ebx
mov eax, edi
xor ecx, ecx
call fcn.4a5080ac
jmp 0x4a510648
mov eax, edi
mov edx, 0x4a51065c
call fcn.4a507a74
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a510660
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebx, eax
test ebx, ebx
je 0x4a510703
test ebx, ebx
setl byte [esp]
mov eax, edi
mov edx, 0xb
call fcn.4a508410
mov esi, 0xb
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov ecx, 0xa
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
mov eax, edi
call fcn.4a507bb0
add bp, 0x30
mov word [eax + esi*2 - 2], bp
dec esi
test ebx, ebx
jne 0x4a510688
cmp byte [esp], 0
je 0x4a5106d1
mov eax, edi
call fcn.4a507bb0
mov word [eax + esi*2 - 2], 0x2d
dec esi
test esi, esi
jle 0x4a51070f
mov eax, edi
call fcn.4a507bb0
push eax
mov eax, edi
call fcn.4a507bb0
lea eax, [eax + esi*2]
mov ebx, 0xb
sub ebx, esi
mov ecx, ebx
add ecx, ecx
pop edx
call fcn.4a504a94
mov edx, ebx
mov eax, edi
call fcn.4a508410
jmp 0x4a51070f
mov eax, edi
mov edx, 0x4a510724
call fcn.4a5079d8
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a5116f8
Capabilities:
Get geographical location

Disassembly:
push ecx
cmp word [0x4a5e4f6c], 0
jne 0x4a511730
push 2
lea eax, [esp + 4]
push eax
push 0xe
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4a511727
movzx eax, word [esp]
mov word [0x4a5e4f6c], ax
jmp 0x4a511730
mov word [0x4a5e4f6c], 0x2c
movzx eax, word [0x4a5e4f6c]
pop edx
ret
Function at 0x4a511d04
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4a511d0c
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a511f1e
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x4a511d4f
lea edx, [ebp - 0xc]
mov eax, ebx
call dword [0x4a5e4cf0]
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.4a5083c0
jmp 0x4a511eeb
test ebx, 0xc0000000
je 0x4a511d97
lea edx, [ebp - 0x10]
mov eax, dword [0x4a5e4f84]
call fcn.4a511f3c
mov eax, dword [ebp - 0x10]
call fcn.4a507f78
push eax
lea edx, [ebp - 0x14]
mov eax, dword [0x4a5e4d68]
call fcn.4a511f3c
mov eax, dword [ebp - 0x14]
call fcn.4a507f78
push eax
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress_2
test eax, eax
je 0x4a511d97
push ebx
call eax
mov ebx, eax
mov edi, 0x1300
cmp ebx, 0x834
jb 0x4a511ddc
cmp ebx, 0xbb7
ja 0x4a511ddc
push 2
push 0
lea edx, [ebp - 0x18]
mov eax, dword [0x4a5e4f80]
call fcn.4a511f3c
mov eax, dword [ebp - 0x18]
call fcn.4a507f78
push eax
call sub.kernel32.dll_LoadLibraryExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a511de1
or edi, 0x800
jmp 0x4a511de1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a511ee4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x400
push ebx
mov eax, dword [ebp - 8]
push eax
push edi
call sub.kernel32.dll_FormatMessageW
test eax, eax
je 0x4a511e84
xor eax, eax
push ebp
push 0x4a511e7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.4a508350
mov eax, dword [esi]
call fcn.4a507ae8
mov ebx, eax
test ebx, ebx
jbe 0x4a511e66
mov eax, dword [esi]
movzx edi, word [eax + ebx*2 - 2]
cmp di, 0xd
jne 0x4a511e4d
mov eax, esi
call fcn.4a507bb0
mov word [eax + ebx*2 - 2], 0x20
jmp 0x4a511e61
cmp di, 0xa
jne 0x4a511e61
mov eax, esi
mov ecx, 1
mov edx, ebx
call fcn.4a5086a0
dec ebx
test ebx, ebx
ja 0x4a511e30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a511ec7
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LocalFree_1
ret
lea edx, [ebp - 0x20]
mov eax, dword [0x4a5e4f88]
call fcn.4a511f3c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.4a5083c0
push dword [ebp - 0x1c]
push 0x4a511f38
lea eax, [ebp - 0x24]
push eax
mov cx, 0x30
mov edx, 1
mov eax, ebx
call fcn.4a511078
push dword [ebp - 0x24]
mov eax, esi
mov edx, 3
call fcn.4a508570
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a511eeb
cmp dword [ebp - 8], 0
je 0x4a511ee3
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a511f25
lea eax, [ebp - 0x24]
call fcn.4a507618
lea eax, [ebp - 0x20]
call fcn.4a50763c
lea eax, [ebp - 0x1c]
call fcn.4a507618
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.4a5076a8
ret
Function at 0x4a511f3c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.4a507a74
mov eax, ebx
call fcn.4a507bc8
mov eax, dword [ebx]
call fcn.4a507af4
test eax, eax
jle 0x4a511f6d
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x4a511f62
pop esi
pop ebx
ret

Function at 0x4a513018
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a513119
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x30]
call fcn.4a509254
mov esi, eax
lea eax, [esi + 1]
push eax
lea eax, [ebx + 0x30]
mov ecx, 1
mov edx, dword [0x4a512824]
call fcn.4a509478
add esp, 4
lea eax, [esi + esi*2]
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x38]
mov dword [edx + eax*8], ecx
mov ecx, dword [ebx + 0x3c]
mov dword [edx + eax*8 + 4], ecx
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebp + 8]
mov dword [edx + eax*8 + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [edx + eax*8 + 0xc], ecx
test edi, edi
jne 0x4a51309a
test esi, esi
jle 0x4a51309a
lea edi, [esi + esi*2]
mov eax, dword [ebx + 0x30]
lea eax, [eax + edi*8 + 0x10]
mov edx, dword [ebx + 0x30]
mov edx, dword [edx + edi*8 - 8]
call fcn.4a5079d8
jmp 0x4a5130ab
lea eax, [esi + esi*2]
mov edx, dword [ebx + 0x30]
lea eax, [edx + eax*8 + 0x10]
mov edx, edi
call fcn.4a5079d8
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add dword [ebx + 0x38], eax
adc dword [ebx + 0x3c], edx
test esi, esi
jne 0x4a513103
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a5130de
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x10]
call fcn.4a5082f8
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.user32.dll_SetWindowTextW
jmp 0x4a513103
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x30]
mov edx, dword [edx + 0x10]
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 4]
call fcn.4a507f78
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.user32.dll_SetWindowTextA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a513120
lea eax, [ebp - 4]
call fcn.4a50763c
ret
Function at 0x4a515b80
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4a515b88
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a515d7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.4a507618
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x4a515be2
lea eax, [ebp - 0x20]
mov edx, ebx
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call dword [0x4a5e4ff4]
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.4a5083c0
jmp 0x4a515d43
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.4a5082f8
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a515d43
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.4a508410
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4a515d43
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4a515d8c
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4a515c81
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
jne 0x4a515c53
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
je 0x4a515c81
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, esi
call fcn.4a515864
jmp 0x4a515d43
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4a515d90
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4a515d43
cmp dword [ebp - 0x14], 0
je 0x4a515d43
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4a515dd0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.4a50e134
mov edx, dword [ebp - 0x14]
movzx edx, word [edx]
call fcn.4a50e128
mov cx, 0x30
mov edx, 8
call fcn.4a510f34
mov eax, dword [ebp - 0x30]
mov ecx, 0x7fffffff
mov edx, 2
call fcn.4a508658
push dword [ebp - 0x2c]
push 0x4a515e00
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.4a508570
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.4a5083f4
mov eax, dword [ebp - 0x24]
call fcn.4a5081f4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4a515d43
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x18]
call fcn.4a508350
mov eax, dword [ebp - 0x34]
mov ebx, dword [0x4a5ed454]
mov ebx, dword [ebx]
mov edx, esi
call ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a515d82
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.4a507678
lea eax, [ebp - 0x24]
call fcn.4a507660
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.4a5076a8
lea eax, [ebp - 4]
call fcn.4a507618
ret