joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46757a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1a1
mov dword [ebp - 0x24], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x467614
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x5564664b
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x6765726e
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x18], 0x65747369
push edi
mov dword [ebp - 0x14], 0x6c614372
mov dword [ebp - 0x10], 0x74756f6c
mov dword [ebp - 0xc], 0x72746e45
mov dword [ebp - 8], 0x79
call fcn.00404e08
cmp al, 1
jne 0x467614
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x467614
cmp eax, dword [ebp + 0xc]
jae 0x467614
push eax
push 0x7e0
call fcn.004356b2
mov eax, dword [ebp - 0x24]
add eax, esi
push eax
push 0x7e1
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x4677b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1a1
mov dword [ebp - 0x1c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x467844
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x52726d4e
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x73696765
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x50726574
push edi
mov dword [ebp - 0xc], 0x69766f72
mov dword [ebp - 8], 0x726564
call fcn.00404e08
cmp al, 1
jne 0x467844
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x467844
cmp eax, dword [ebp + 0xc]
jae 0x467844
push eax
push 0x7d7
call fcn.004356b2
mov eax, dword [ebp - 0x1c]
add eax, esi
push eax
push 0x7d8
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x467a9a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1a1
mov dword [ebp - 0x2c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x467b42
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x4469734e
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x67657265
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0x65747369
push edi
mov dword [ebp - 0x1c], 0x61684372
mov dword [ebp - 0x18], 0x4e65676e
mov dword [ebp - 0x14], 0x6669746f
mov dword [ebp - 0x10], 0x74616369
mov dword [ebp - 0xc], 0x456e6f69
mov dword [ebp - 8], 0x78
call fcn.00404e08
cmp al, 1
jne 0x467b42
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x467b42
cmp eax, dword [ebp + 0xc]
jae 0x467b42
push eax
push 0x7c8
call fcn.004356b2
mov eax, dword [ebp - 0x2c]
add eax, esi
push eax
push 0x7c9
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x467b58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1a1
mov dword [ebp - 0x24], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x467bf2
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x4469734e
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x67657265
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x18], 0x65747369
push edi
mov dword [ebp - 0x14], 0x67654c72
mov dword [ebp - 0x10], 0x48796361
mov dword [ebp - 0xc], 0x6c646e61
mov dword [ebp - 8], 0x7265
call fcn.00404e08
cmp al, 1
jne 0x467bf2
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x467bf2
cmp eax, dword [ebp + 0xc]
jae 0x467bf2
push eax
push 0x7ce
call fcn.004356b2
mov eax, dword [ebp - 0x24]
add eax, esi
push eax
push 0x7cf
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x467c08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1a1
mov dword [ebp - 0x1c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x467c94
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x4769734e
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x6f4d7465
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x656c7564
push edi
mov dword [ebp - 0xc], 0x646e6148
mov dword [ebp - 8], 0x656c
call fcn.00404e08
cmp al, 1
jne 0x467c94
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x467c94
cmp eax, dword [ebp + 0xc]
jae 0x467c94
push eax
push 0x7ca
call fcn.004356b2
mov eax, dword [ebp - 0x1c]
add eax, esi
push eax
push 0x7cb
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x468156
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1a1
mov dword [ebp - 0x1c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x4681e2
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x57746553
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x65447066
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x65636976
push edi
mov dword [ebp - 0xc], 0x656a624f
mov dword [ebp - 8], 0x7463
call fcn.00404e08
cmp al, 1
jne 0x4681e2
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4681e2
cmp eax, dword [ebp + 0xc]
jae 0x4681e2
push eax
push 0x7d4
call fcn.004356b2
mov eax, dword [ebp - 0x1c]
add eax, esi
push eax
push 0x7d5
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x46828a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1a1
mov dword [ebp - 0x28], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x468327
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x4e706657
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x6e496c62
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0x69446f66
push edi
mov dword [ebp - 0x18], 0x74617073
mov dword [ebp - 0x14], 0x61546863
mov dword [ebp - 0x10], 0x43656c62
mov dword [ebp - 0xc], 0x7261656c
mov dword [ebp - 8], ebx
call fcn.00404e08
cmp al, 1
jne 0x468327
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x468327
cmp eax, dword [ebp + 0xc]
jae 0x468327
push eax
push 0x7b2
call fcn.004356b2
mov eax, dword [ebp - 0x28]
add eax, esi
push eax
push 0x7b3
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x46833c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1a1
mov dword [ebp - 0x18], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x4683c1
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x53706657
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x74726174
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x5363614d
push edi
mov dword [ebp - 8], 0x6d6968
call fcn.00404e08
cmp al, 1
jne 0x4683c1
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4683c1
cmp eax, dword [ebp + 0xc]
jae 0x4683c1
push eax
push 0x7d1
call fcn.004356b2
mov eax, dword [ebp - 0x18]
add eax, esi
push eax
push 0x7d2
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x4684cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1a1
mov dword [ebp - 0x1c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x468558
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x53706657
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x74726174
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x65727453
push edi
mov dword [ebp - 0xc], 0x68536d61
mov dword [ebp - 8], 0x6d69
call fcn.00404e08
cmp al, 1
jne 0x468558
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x468558
cmp eax, dword [ebp + 0xc]
jae 0x468558
push eax
push 0x7c1
call fcn.004356b2
mov eax, dword [ebp - 0x1c]
add eax, esi
push eax
push 0x7c2
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x46856e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1a1
mov dword [ebp - 0x1c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x4685fa
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x53706657
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x53706f74
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x61657274
push edi
mov dword [ebp - 0xc], 0x6968536d
mov dword [ebp - 8], 0x6d
call fcn.00404e08
cmp al, 1
jne 0x4685fa
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4685fa
cmp eax, dword [ebp + 0xc]
jae 0x4685fa
push eax
push 0x7c3
call fcn.004356b2
mov eax, dword [ebp - 0x1c]
add eax, esi
push eax
push 0x7c4
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x46a1f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x730079
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x5c]
push 1
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0x53005c
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x4c], 0x650074
push eax
mov dword [ebp - 0x48], 0x52006d
mov dword [ebp - 0x44], 0x6f006f
mov dword [ebp - 0x40], 0x5c0074
mov dword [ebp - 0x3c], 0x790073
mov dword [ebp - 0x38], 0x740073
mov dword [ebp - 0x34], 0x6d0065
mov dword [ebp - 0x30], 0x320033
mov dword [ebp - 0x2c], 0x64005c
mov dword [ebp - 0x28], 0x690072
mov dword [ebp - 0x24], 0x650076
mov dword [ebp - 0x20], 0x730072
mov dword [ebp - 0x1c], 0x6e005c
mov dword [ebp - 0x18], 0x740065
mov dword [ebp - 0x14], 0x6f0069
mov dword [ebp - 0x10], 0x73002e
mov dword [ebp - 8], ebx
call fcn.00439b16
test eax, eax
jne 0x46a2cb
push ebx
push edi
push esi
push dword [ebp - 0x5c]
push dword [ebp - 0x58]
call fcn.00405020
cmp al, 1
jne 0x46a2c3
mov bl, al
push dword [ebp - 0x58]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x46a2e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x4b47
xor esi, esi
call fcn.004355f2
push 0x4b80
mov dword [ebp - 0x24], eax
call fcn.004355f2
push 0x4b4d
mov ebx, eax
call fcn.004355f2
mov edi, eax
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x46a37c
test ebx, ebx
je 0x46a37c
test edi, edi
je 0x46a37c
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x44005c
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0x760065
push ecx
mov dword [ebp - 0x14], 0x630069
mov dword [ebp - 0x10], 0x5c0065
mov dword [ebp - 0xc], 0x660077
mov dword [ebp - 8], 0x70
call eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x80
lea eax, [ebp - 0x30]
push eax
call ebx
test eax, eax
js 0x46a37c
mov ecx, dword [ebp - 0x20]
mov esi, dword [ecx + 4]
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret

Function at 0x46a7a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
push eax
push 2
push 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x44005c
push eax
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x5c0072
mov dword [ebp - 0x18], 0x62004b
mov dword [ebp - 0x14], 0x430064
mov dword [ebp - 0x10], 0x61006c
mov dword [ebp - 0xc], 0x730073
call fcn.0046a4bc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x46cd58
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x61
call fcn.004355f2
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov edi, eax
sub edi, esi
neg edi
sbb edi, edi
and edi, esi
mov dword [ebp - 0x38], edi
je 0x46cd93
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
call fcn.0046db2a
push 0x20
call fcn.004355f2
push 0x21
mov ebx, eax
call fcn.004355f2
mov esi, eax
test ebx, ebx
je 0x46cf1e
test esi, esi
je 0x46cf1e
and dword [ebp - 0x48], 0
lea eax, [ebp - 0x4c]
and dword [ebp - 0x50], 0
push eax
push esi
push ebx
mov dword [ebp - 0x4c], 0x54494e49
mov dword [ebp - 0x54], 0x45474150
call fcn.00404f50
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x54]
push eax
push esi
push ebx
call fcn.00404f50
mov ecx, eax
mov eax, dword [ebp - 0x20]
cmp eax, ecx
jbe 0x46cdf4
mov eax, ecx
cmp eax, esi
sbb ecx, ecx
and ecx, eax
mov eax, dword [ebx + 0x3c]
mov dword [ebp - 0x40], ecx
mov edx, dword [eax + ebx + 0xa4]
mov dword [ebp - 0x2c], edx
test edx, edx
je 0x46cf1e
mov ecx, dword [eax + ebx + 0xa0]
mov dword [ebp - 0x3c], ecx
cmp ecx, esi
jae 0x46cf1e
lea eax, [ecx + 8]
cmp eax, esi
jae 0x46cf1e
cmp edx, esi
jae 0x46cf1e
lea eax, [ecx + edx]
cmp eax, esi
ja 0x46cf1e
and dword [ebp - 0x30], 0
lea eax, [ecx + ebx]
mov dword [ebp - 0x28], eax
test edx, edx
je 0x46cf1e
mov edi, dword [ebp - 0x30]
lea edx, [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x44], edx
mov edx, dword [edx]
add edi, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], eax
cmp eax, esi
jae 0x46cf1b
mov eax, edx
cmp eax, esi
ja 0x46cf1b
cmp eax, 8
jbe 0x46cf1b
lea eax, [edi + ecx]
cmp eax, esi
jae 0x46cf1b
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x40]
jb 0x46cefe
add eax, ebx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x34], eax
mov eax, edx
add eax, 0xfffffff8
shr eax, 1
mov dword [ebp - 0x20], eax
je 0x46cefe
mov ecx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
movzx eax, word [ecx + edi*2 + 8]
mov edx, eax
mov dword [ebp - 0x24], 0x3000
and eax, 0xf000
and edx, 0xfff
cmp word [ebp - 0x24], ax
jne 0x46cef2
mov eax, dword [ecx]
add eax, 4
add eax, edx
cmp eax, esi
jae 0x46cef2
mov eax, dword [ebp - 0x34]
add eax, edx
push eax
push esi
push ebx
call fcn.0046cb5c
mov ecx, dword [ebp - 0x28]
inc edi
cmp edi, dword [ebp - 0x20]
jb 0x46ceb8
mov ecx, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x30]
lea eax, [edi + 8]
add eax, ecx
cmp eax, esi
jae 0x46cf1b
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
add eax, dword [edx]
mov dword [ebp - 0x28], eax
cmp edi, dword [ebp - 0x2c]
jb 0x46ce57
mov edi, dword [ebp - 0x38]
test edi, edi
pop edi
pop esi
pop ebx
je 0x46cf2e
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
push 1
push 0x1cb
call fcn.004356b2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x46ecc2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x60
push 0x48d100
call fcn.004011b4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
push 0x4b47
call fcn.004355f2
mov dword [ebp - 0x3c], eax
push 0x4b62
call fcn.004355f2
mov ebx, eax
push 0x4af0
call fcn.004355f2
mov esi, eax
push 0x4b4d
call fcn.004355f2
mov edi, eax
mov dword [ebp - 0x48], edi
push 0x4c5e
call fcn.004355f2
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x46ee0b
test ebx, ebx
je 0x46ee0b
test esi, esi
je 0x46ee0b
test edi, edi
je 0x46ee0b
test eax, eax
je 0x46ee0b
mov dword [ebp - 0x38], 0x4f005c
mov dword [ebp - 0x34], 0x6a0062
mov dword [ebp - 0x30], 0x630065
mov dword [ebp - 0x2c], 0x540074
mov dword [ebp - 0x28], 0x700079
mov dword [ebp - 0x24], 0x730065
xor edi, edi
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x70]
push eax
call ecx
mov dword [ebp - 0x68], 0x18
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x5c], 0x240
lea eax, [ebp - 0x70]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], edi
lea eax, [ebp - 0x68]
push eax
push 1
lea eax, [ebp - 0x40]
push eax
call ebx
test eax, eax
js 0x46ee0b
push edi
lea eax, [ebp - 0x44]
push eax
push edi
push edi
push 0xf000f
push dword [ebp - 0x40]
call esi
test eax, eax
js 0x46ee05
push 0x80000
push 1
call fcn.00478d6e
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x46edff
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
push dword [ebp - 0x50]
push 0x20000
push eax
call fcn.0046e9cc
jmp 0x46edf0
mov dword [ebp - 4], 0xfffffffe
push dword [ebp - 0x3c]
call fcn.00478d8c
mov ecx, dword [ebp - 0x44]
call dword [ebp - 0x48]
push dword [ebp - 0x40]
call dword [ebp - 0x4c]
xor al, al
call fcn.004011fc
ret 8
Function at 0x472d4c
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x61
call fcn.004355f2
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov edi, eax
sub edi, esi
neg edi
sbb edi, edi
and edi, esi
mov dword [ebp - 0xd4], edi
je 0x472d8f
lea eax, [ebp - 0xd0]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push 0x21
call fcn.004355f2
mov esi, eax
push 3
mov dword [ebp - 0xd8], esi
call fcn.004355f2
mov dword [ebp - 0xdc], eax
test esi, esi
je 0x472fd3
test eax, eax
je 0x472fd3
push ebx
push 0xb4
lea eax, [ebp - 0xb8]
push 0
push eax
call sub.ntoskrnl.exe_memset
mov edi, dword [ebp - 0xdc]
lea ebx, [ebp - 0xb4]
add esp, 0xc
mov dword [ebp - 0xb8], 0x4b1c
mov dword [ebp - 0xb4], 0x16e
mov dword [ebp - 0xb0], 0x39
mov dword [ebp - 0xac], 0x4b1f
mov dword [ebp - 0xa8], 0x16f
mov dword [ebp - 0xa4], 0x3a
mov dword [ebp - 0xa0], 0x4b22
mov dword [ebp - 0x9c], 0x170
mov dword [ebp - 0x98], 0x3b
mov dword [ebp - 0x94], 0x4b25
mov dword [ebp - 0x90], 0x171
mov dword [ebp - 0x8c], 0x3c
mov dword [ebp - 0x88], 0x4b2e
mov dword [ebp - 0x84], 0x172
mov dword [ebp - 0x80], 0x3d
mov dword [ebp - 0x7c], 0x4b31
mov dword [ebp - 0x78], 0x173
mov dword [ebp - 0x74], 0x3e
mov dword [ebp - 0x70], 0x4b34
mov dword [ebp - 0x6c], 0x174
mov dword [ebp - 0x68], 0x3f
mov dword [ebp - 0x64], 0x4b37
mov dword [ebp - 0x60], 0x175
mov dword [ebp - 0x5c], 0x40
mov dword [ebp - 0x58], 0x4b3a
mov dword [ebp - 0x54], 0x176
mov dword [ebp - 0x50], 0x41
mov dword [ebp - 0x4c], 0x4b3d
mov dword [ebp - 0x48], 0x177
mov dword [ebp - 0x44], 0x42
mov dword [ebp - 0x40], 0x4b40
mov dword [ebp - 0x3c], 0x178
mov dword [ebp - 0x38], 0x43
mov dword [ebp - 0x34], 0x4bd6
mov dword [ebp - 0x30], 0x290
mov dword [ebp - 0x2c], 0x63
mov dword [ebp - 0x28], 0x4bd9
mov dword [ebp - 0x24], 0x291
mov dword [ebp - 0x20], 0x64
mov dword [ebp - 0x1c], 0x4bdc
mov dword [ebp - 0x18], 0x292
mov dword [ebp - 0x14], 0x65
mov eax, dword [ebx - 4]
test eax, eax
jne 0x472f3e
cmp dword [ebx], eax
jne 0x472f3e
cmp dword [ebx + 4], eax
je 0x472f75
push eax
call fcn.0047afa2
test eax, eax
je 0x472f70
push eax
call fcn.0047af20
test eax, eax
je 0x472f70
cmp eax, esi
jae 0x472f70
lea esi, [eax + edi]
push esi
push dword [ebx]
call fcn.004356b2
push esi
push dword [ebx + 4]
call fcn.0047700e
mov esi, dword [ebp - 0xd8]
add ebx, 0xc
jmp 0x472f2e
call fcn.004216be
call fcn.0041fb56
call fcn.0041fd2c
call fcn.00420b96
call fcn.00421036
call fcn.004214fe
call fcn.0041f318
call fcn.0041f65e
call fcn.0042053e
call fcn.004213ae
push 0x914
call fcn.004355f2
mov edi, dword [ebp - 0xd4]
pop ebx
cmp eax, 0x1770
jb 0x472fd3
call fcn.0041f15e
call fcn.00420a20
call fcn.0042082e
call fcn.0041fd46
call fcn.004218a4
test edi, edi
pop edi
pop esi
je 0x472fea
lea eax, [ebp - 0xd0]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x4778c0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x60
push 0
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
pop esi
pop ebp
ret 4
Function at 0x47952e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
test esi, esi
je 0x4796f7
push edi
mov edi, 0x914
xor ebx, ebx
push edi
inc ebx
call fcn.004355f2
cmp eax, 0x893
je 0x4796f6
mov esi, dword [esi + 0x2c]
push edi
call fcn.004355f2
cmp eax, 0x1770
jae 0x4796de
cmp esi, 2
je 0x479593
cmp esi, 7
je 0x479593
cmp esi, 0x1f
je 0x479593
cmp esi, 0x24
jne 0x4796f6
push 0x4b47
call fcn.004355f2
push 0x4b80
mov dword [ebp - 0x4c], eax
call fcn.004355f2
push 0x4b4d
mov dword [ebp - 0x40], eax
call fcn.004355f2
push 0x4c67
mov edi, eax
call fcn.004355f2
push 0x4ac3
mov dword [ebp - 0x3c], eax
call fcn.004355f2
mov esi, eax
push 0x4c6a
mov dword [ebp - 0x44], esi
call fcn.004355f2
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
test ecx, ecx
je 0x4796f6
cmp dword [ebp - 0x40], 0
je 0x4796f6
test edi, edi
je 0x4796f6
cmp dword [ebp - 0x3c], 0
je 0x4796f6
test esi, esi
je 0x4796f6
test eax, eax
je 0x4796f6
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x44005c
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x34], 0x760065
push eax
mov dword [ebp - 0x30], 0x630069
mov dword [ebp - 0x2c], 0x5c0065
mov dword [ebp - 0x28], 0x6f004d
mov dword [ebp - 0x24], 0x6e0075
mov dword [ebp - 0x20], 0x500074
mov dword [ebp - 0x1c], 0x69006f
mov dword [ebp - 0x18], 0x74006e
mov dword [ebp - 0x14], 0x61004d
mov dword [ebp - 0x10], 0x61006e
mov dword [ebp - 0xc], 0x650067
mov dword [ebp - 8], 0x72
call ecx
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x80
lea eax, [ebp - 0x64]
push eax
call dword [ebp - 0x40]
test eax, eax
js 0x4796f6
mov eax, dword [ebp - 0x50]
mov esi, dword [eax + 0x28]
test esi, esi
je 0x4796d7
add esi, 0x1c
push esi
call dword [ebp - 0x3c]
test eax, eax
jne 0x4796d7
or dword [ebp - 0x58], 0xffffffff
lea eax, [ebp - 0x5c]
push eax
xor eax, eax
mov dword [ebp - 0x5c], 0xff676980
push eax
push eax
push eax
push esi
call dword [ebp - 0x44]
cmp eax, 0x102
je 0x4796d5
push 0
push ebx
push 0
push esi
call dword [ebp - 0x54]
jmp 0x4796d7
xor bl, bl
mov ecx, dword [ebp - 0x48]
call edi
jmp 0x4796f6
push 0x4c70
call fcn.004355f2
test eax, eax
je 0x4796f6
call eax
dec al
neg al
sbb al, al
and bl, al
pop edi
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 4