joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4800f7a9
Capabilities:
Link many functions at runtime
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push edi
mov ebx, 0x80004005
push str.wininet.dll
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x4800f7d7
mov eax, ebx
jmp 0x4800f942
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenW
push eax
call esi
cmp eax, edi
mov dword [0x48025fc8], eax
jne 0x4800f7f6
mov eax, ebx
jmp 0x4800f941
push str.InternetReadFile
push dword [ebp - 4]
call esi
cmp eax, edi
mov dword [0x48025fd8], eax
je 0x4800f7ef
push str.InternetCloseHandle
push dword [ebp - 4]
call esi
cmp eax, edi
mov dword [0x48025fdc], eax
je 0x4800f7ef
push str.HttpSendRequestW
push dword [ebp - 4]
call esi
cmp eax, edi
mov dword [0x48025fd4], eax
je 0x4800f7ef
push str.HttpOpenRequestW
push dword [ebp - 4]
call esi
cmp eax, edi
mov dword [0x48025fd0], eax
je 0x4800f7ef
push str.InternetConnectW
push dword [ebp - 4]
call esi
cmp eax, edi
mov dword [0x48025fcc], eax
je 0x4800f7ef
push edi
push edi
push edi
push edi
push str.Mozilla_5.0__compatible__Google_Desktop_
call dword [0x48025fc8]
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x4800f7ef
push edi
push edi
push 3
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [0x48025fcc]
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x4800f910
cmp dword [ebp + 0x18], edi
mov dword [ebp - 0x1c], 0x4801f8d4
mov dword [ebp - 0x18], edi
mov eax, 0x4801f8b4
jne 0x4800f8a2
mov eax, 0x4801f8ac
push edi
push 0x84000100
lea ecx, [ebp - 0x1c]
push ecx
push edi
push str.HTTP_1.1
push dword [ebp + 0x10]
push eax
push dword [ebp - 0xc]
call dword [0x48025fd0]
mov esi, eax
cmp esi, edi
je 0x4800f91e
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x1c]
push esi
call dword [0x48025fd4]
test eax, eax
je 0x4800f913
mov ebx, 0x3e8
jmp 0x4800f8ef
cmp dword [ebp - 8], edi
je 0x4800f90b
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x404]
push eax
push esi
mov dword [ebp - 8], edi
call dword [0x48025fd8]
test eax, eax
jne 0x4800f8ea
jmp 0x4800f913
mov dword [ebp - 0x10], edi
jmp 0x4800f913
mov esi, dword [ebp - 0x14]
cmp esi, edi
je 0x4800f91e
push esi
call dword [0x48025fdc]
cmp dword [ebp - 0xc], edi
je 0x4800f92c
push dword [ebp - 0xc]
call dword [0x48025fdc]
push dword [ebp - 0x14]
call dword [0x48025fdc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x10]
pop esi
pop edi
pop ebx
leave
ret
Function at 0x4800f946
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4800f9ba
push ebx
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea esi, [esi + esi + 2]
push esi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, esi
mov esi, dword [esp + 0x10]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x4800f9b1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
ret

Function at 0x4800f9bc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp byte [0x48027491], 0
jne 0x4800fa15
push edi
push 0x44
pop ecx
xor eax, eax
mov dword [ebp - 0x114], 0x114
lea edi, [ebp - 0x110]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
pop edi
jne 0x4800f9fc
xor al, al
leave
ret
cmp dword [ebp - 0x110], 6
mov byte [0x48027491], 1
sbb al, al
inc al
mov byte [0x48027490], al
leave
ret
mov al, byte [0x48027490]
leave
ret

Function at 0x4800fb06
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
call fcn.4800faf5
cmp dword [0x48023f80], eax
mov dword [ebp - 4], eax
je 0x4800fbeb
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
push 0xc
pop ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x11
mov edi, 0x400
push edi
call esi
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x12
push edi
call esi
push 0x14
lea eax, [ebp - 0x3c]
push eax
push 0x10
push edi
call esi
push ebx
push 0x48027520
push 0xe
push edi
call esi
push ebx
mov ebx, 0x48027514
push ebx
push 0xf
push edi
call esi
push 0xc
lea eax, [ebp - 0x28]
push eax
push 0x1010
push edi
call esi
xor esi, esi
push esi
lea ecx, [ebp - 0x10]
call fcn.4800c0c0
push esi
lea ecx, [ebp - 0x1c]
mov dword [0x480274fc], eax
call fcn.4800c0c0
push esi
mov dword [0x48027500], eax
push 0xa
push str.3_2_0
lea eax, [ebp - 0x3c]
call fcn.4800bfca
add esp, 0x14
test eax, eax
jne 0x4800fbb6
mov dword [0x48027504], 0x20
jmp 0x4800fbc3
mov eax, dword [ebp - 0x3c]
call fcn.4800c3e5
mov dword [0x48027504], eax
push esi
lea ecx, [ebp - 0x28]
mov dword [0x48027508], 0x48027520
mov dword [0x4802750c], ebx
call fcn.4800c0c0
mov dword [0x48027510], eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [0x48023f80], eax
pop ebx
mov edi, dword [ebp + 8]
push 6
pop ecx
mov esi, 0x480274fc
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret
Function at 0x48010656
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0x3e8
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.48017cd0
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1c]
push eax
mov ebx, edx
call esi
rdtsc
and dword [ebp - 4], 0
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
mov edi, 0xc350
lea eax, [ebp - 0xc]
push eax
call esi
inc dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
sbb eax, dword [ebp - 0x18]
cmp eax, ebx
ja 0x480106c2
jb 0x480106bd
cmp ecx, dword [ebp - 0x2c]
jae 0x480106c2
cmp dword [ebp - 4], edi
jl 0x4801069d
lea eax, [ebp - 0xc]
push eax
call esi
rdtsc
cmp dword [ebp - 4], edi
mov ebx, edx
mov esi, eax
jl 0x480106e2
mov edi, 0x6adf307c
mov eax, 0x480275c0
call fcn.48009c63
push dword [ebp - 0x10]
sub esi, dword [ebp - 0x24]
push dword [ebp - 0x14]
sbb ebx, dword [ebp - 0x20]
push ebx
push esi
call fcn.48017c70
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 8]
sbb esi, dword [ebp - 0x18]
push esi
push ecx
push edx
push eax
call fcn.48017cd0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48010e44
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x48027644]
push ebx
push edi
mov edi, 0x48027644
mov ecx, edi
call dword [eax + 4]
cmp byte [0x480274b4], 0
mov bl, al
je 0x48010e75
test bl, bl
je 0x48010e6e
mov eax, dword [0x48027644]
mov ecx, edi
call dword [eax + 8]
xor eax, eax
jmp 0x4801106a
call fcn.48010d94
test eax, eax
jne 0x48010e96
test bl, bl
je 0x48010e8c
mov eax, dword [0x48027644]
mov ecx, edi
call dword [eax + 8]
mov eax, 0x80004005
jmp 0x4801106a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 2
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023fcc], eax
jne 0x48010ec8
test bl, bl
je 0x48010ebe
mov eax, dword [0x48027644]
mov ecx, edi
call dword [eax + 8]
mov eax, 0x80004005
jmp 0x48011069
push 3
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023fc8], eax
je 0x48010eb0
push 4
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023fc4], eax
je 0x48010eb0
push 5
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023fbc], eax
je 0x48010eb0
push 6
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023fb8], eax
je 0x48010eb0
push 7
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023fc0], eax
je 0x48010eb0
push 9
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023fb4], eax
je 0x48010eb0
push 0xa
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023fb0], eax
je 0x48010eb0
push 0xe
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023fac], eax
je 0x48010eb0
push 0xf
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023fa8], eax
je 0x48010eb0
push 0x15
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023fa4], eax
je 0x48010eb0
push 0x10
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023f8c], eax
je 0x48010eb0
push 0x11
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023fa0], eax
je 0x48010eb0
push 0x13
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023f9c], eax
je 0x48010eb0
push 0x16
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023f98], eax
je 0x48010eb0
push 0xb
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023f94], eax
je 0x48010eb0
push 8
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023f90], eax
je 0x48010eb0
push 0x12
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023f88], eax
je 0x48010eb0
push 0x26
push dword [0x480274b0]
call esi
test eax, eax
mov dword [0x48023f84], eax
je 0x48010eb0
test bl, bl
mov byte [0x480274b4], 1
je 0x48011067
mov eax, dword [0x48027644]
mov ecx, edi
call dword [eax + 8]
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x480126af
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
lea eax, [ebx + 0x10]
push eax
push 0x48021574
lea eax, [ebx + 0xc]
lea edi, [ebp - 4]
call fcn.48007ba8
pop ecx
lea edi, [ebp - 8]
call fcn.48007b4f
mov eax, dword [ebp - 4]
pop ecx
add eax, 0xfffffff0
call fcn.48001fbe
mov edi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x480127aa
push dword [ebp - 8]
lea eax, [ebp - 0x210]
call fcn.4800babe
test eax, eax
pop ecx
je 0x4801271f
mov dword [ebx + 0x14], edi
xor esi, esi
inc esi
jmp 0x480127ac
lea eax, [ebp - 0x210]
push eax
lea esi, [ebp - 4]
call fcn.48004c5c
mov eax, esi
push eax
lea esi, [ebx + 0x3c]
call fcn.48012990
mov byte [ebp + 0xb], al
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.48001fbe
cmp byte [ebp + 0xb], 0
je 0x48012752
mov dword [ebx + 0x18], edi
jmp 0x480127aa
lea eax, [ebp - 0x210]
push eax
lea esi, [ebp - 4]
call fcn.48004c5c
mov eax, esi
push eax
lea esi, [ebx + 0x4c]
call fcn.48012990
mov byte [ebp + 0xb], al
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.48001fbe
cmp byte [ebp + 0xb], 0
je 0x480127aa
xor esi, esi
push esi
push str.MDIClient
push esi
push edi
call dword [sym.imp.USER32.dll_FindWindowExW]
cmp eax, esi
je 0x480127aa
push ebx
push 0x48012698
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp dword [ebx + 0x14], esi
jne 0x48012717
xor esi, esi
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.48001fbe
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x48016db5
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
test byte [0x48027560], 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
jne 0x48016de5
or dword [0x48027560], 1
push str.DnsQuery_W
call fcn.48016d9b
push eax
call esi
mov dword [0x4802755c], eax
test byte [0x48027560], 2
jne 0x48016e07
or dword [0x48027560], 2
push str.DnsFree
call fcn.48016d9b
push eax
call esi
mov dword [0x48027558], eax
lea ecx, [ebp - 4]
call fcn.480017fe
mov eax, dword [0x4802755c]
xor edi, edi
cmp eax, edi
je 0x48016e9f
cmp dword [0x48027558], edi
je 0x48016e9f
push edi
lea ecx, [ebp - 8]
push ecx
push edi
push dword [ebp + 0x10]
mov dword [ebp - 8], edi
push 1
push dword [ebp + 0xc]
call eax
test eax, eax
je 0x48016e5c
mov esi, dword [ebp + 8]
push 0x4801b36c
call fcn.48004c5c
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.48001fbe
mov eax, esi
jmp 0x48016f10
mov esi, dword [ebp - 8]
cmp esi, edi
je 0x48016e92
cmp word [esi + 8], 1
je 0x48016e70
mov esi, dword [esi]
cmp esi, edi
jne 0x48016e63
cmp esi, edi
je 0x48016e92
push dword [esi + 0x18]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 4]
call fcn.48004cbb
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x48016e92
mov ecx, dword [esi + 0x10]
mov dword [eax], ecx
push 1
push dword [ebp - 8]
call dword [0x48027558]
jmp 0x48016ef2
push dword [ebp + 0xc]
lea esi, [ebp - 8]
call fcn.48004c5c
mov eax, esi
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.4800b137
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.48001fbe
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.48001fbe
cmp esi, edi
je 0x48016ef2
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 4]
call fcn.48004cbb
mov esi, dword [ebp - 4]
add esi, 0xfffffff0
mov eax, esi
call fcn.48001ca6
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
mov eax, esi
call fcn.48001fbe
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x48017263
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4802323c]
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.480171e5
mov eax, 0x48000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.4800613a
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x480172c5
cmp dword [ebp - 0x1c], 5
jb 0x480172dd
jmp 0x480172d9
cmp dword [ebp - 0x10], 1
jne 0x480172dd
cmp dword [ebp - 0x1c], 4
ja 0x480172d9
jne 0x480172dd
cmp dword [ebp - 0x18], 0
jbe 0x480172dd
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x4801b2dc
call fcn.48001e5d
test eax, eax
jge 0x480172fe
mov byte [0x48024478], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
pop esi
call fcn.48015c65
add ebp, 0x78
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x404532
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x404541
pop dword [ebp - 0x18]
mov eax, 0x404541
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x33efa
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x32ec
mov esi, eax
mov edi, 0x413bc4
add edi, dword [ebp - 0x18]
mov edx, 0x527992f0
sub edx, 0x9508c9a0
xor dword [ebp - 0x10], 0x462b037a
mov ebx, dword [edi]
add dword [ebp - 4], eax
sub ebx, edx
mov dword [esi], ebx
add dword [ebp - 0x14], 0x2a05f0b9
add esi, 0x679ac879
add esi, 0x9865378b
add edi, 4
loop 0x40458a
add eax, 0x7d999139
sub eax, 0x7d98d2b6
xor ebx, ebx
add ebx, eax
add eax, 0xc7765de9
add eax, 0x3889a21c
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x411078
Capabilities:
Terminate process

Disassembly:
jmp 0x419ae0
jmp fcn.0041a530
cmp ecx, dword [0x42529c]
jne 0x419aea
repz ret
jmp 0x41120d
Function at 0x1e7a7500
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 4], 0x1e7ba2c0
je 0x1e7a751c
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
ret 8
mov eax, dword [eax + 8]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [esp + 8]
cmp ecx, 2
jne 0x1e7a7541
test eax, eax
je 0x1e7a754a
mov eax, dword [sym.imp.python27.dll__Py_TrueStruct]
inc dword [eax]
ret 8
cmp ecx, 3
jne 0x1e7a7554
test eax, eax
je 0x1e7a7537
mov eax, dword [sym.imp.python27.dll__Py_ZeroStruct]
inc dword [eax]
ret 8
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
ret 8

Function at 0x1e7a8f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + edi*8 - 1], esi
dec dword [edi]
scasd eax, dword es:[edi]
lea esi, [edi + edi*8 - 1]
invalid
mov dword [ebp + 0xc], ecx
invalid

Function at 0x1e7a9000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
xchg edi, eax
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1e7a8c47
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a8bfc
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a8c47
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a8bfc
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a8c37
sbb dword [ebp - 0x6277ac02], eax
jl 0x1e7a90bc
invalid
invalid
Function at 0x1e7a92a0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1e7a92eb
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1e7a92e6
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
loop 0x1e7a92b2
lock add byte [eax], al
cmp edx, 0x3000
jne 0x1e7a92d0
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1e7a92d8
cmp edx, ebx
jne 0x1e7a9426
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1e7a92a7
add eax, dword [eax + 4]
jmp 0x1e7a9294
mov dword [ebp + 0xc], ebx
jmp 0x1e7a92f6
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a930e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a932c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a938a
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a9371
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a937a
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a9384
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a9366
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1e7a92f0
invalid
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1e7a93d7
dec eax
je 0x1e7a93ce
sub eax, 3
je 0x1e7a93c5
mov dword [ebp - 4], 0x40
jmp 0x1e7a93f4
mov dword [ebp - 4], 4
jmp 0x1e7a93da
mov dword [ebp - 4], 0x20
jmp 0x1e7a93da
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1e7a9426
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1e7a93a6
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1e7a8c37
invalid

Function at 0x1e7a9480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x3a]
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov eax, 0x56fffffc

Function at 0x1e7a94a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x56fffffc
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
invalid
invalid
invalid
cld
invalid
invalid
Function at 0x1e7a9b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ebp - 0x22e43], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
mov ebp, 0xfffff9ad

Function at 0x1e7a9b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ebp, 0xfffff9ad
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1e7a8c15
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
invalid
invalid

Function at 0x1e7ab3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1e7ba8b8]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x1e7ab3dc
cmp dword [esi + 4], edi
je 0x1e7ab3dc
mov ecx, dword [esi]
push ecx
call dword [sym.imp.python27.dll_PyThreadState_Delete]
mov edx, dword [0x1e7ba8b8]
add esp, 4
push edi
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [sym.pywintypes27.dll_struct__object__PyWinExc_ApiError]
mov dword [sym.pywintypes27.dll_struct__is__PyWin_InterpreterState], edi
cmp eax, edi
je 0x1e7ab402
dec dword [eax]
mov eax, dword [sym.pywintypes27.dll_struct__object__PyWinExc_ApiError]
cmp dword [eax], edi
jne 0x1e7ab402
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x18]
push eax
call edx
add esp, 4
mov eax, dword [sym.pywintypes27.dll_struct__object__PyWinExc_COMError]
mov dword [sym.pywintypes27.dll_struct__object__PyWinExc_ApiError], edi
cmp eax, edi
je 0x1e7ab428
dec dword [eax]
mov eax, dword [sym.pywintypes27.dll_struct__object__PyWinExc_COMError]
cmp dword [eax], edi
jne 0x1e7ab428
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x18]
push eax
call edx
add esp, 4
mov dword [sym.pywintypes27.dll_struct__object__PyWinExc_COMError], edi
pop edi
pop esi
ret