joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f3050
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x626d30
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x5f31f7
mov ecx, dword [0x75812c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x5f314c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.005f1d70
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.00613270
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.00613183
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x754ec8
call fcn.006131f1
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.005f2130
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.00613270
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.00613183
lea ecx, [esp + 0xc]
call fcn.0061364b
mov ecx, dword [esp + 0xc]
push 0x755904
push ecx
call fcn.00600904
add esp, 8
test eax, eax
je 0x5f3174
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x5f30ad
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.00613183
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00613183
jmp 0x5f31fb
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.005f2df0
test eax, eax
push 0
je 0x5f31df
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.005f1490
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x5f31c5
cmp eax, 0x64
jg 0x5f31b3
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x5f3150
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x5f3150
cmp eax, 0x64
jge 0x5f314c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x5f3150
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.005f1490
mov esi, eax
jmp 0x5f3150
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x5f3205
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x5fb910
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x756254]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x5fb923
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x5fb964
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x7562fc]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x5fb996
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5fb99a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x5fb98b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x5fb9b8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5fb9bc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x5fb9ad
xor ecx, ecx
mov eax, 0x756264
xor ebx, ebx
mov bl, byte [ecx + 0x75630c]
cmp byte [esp + ebx + 0x14], 0
je 0x5fb9e7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x756324]
cmp byte [esp + ebx + 0x14], 0
je 0x5fb9fe
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x5fb9ce
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x5fb957
lea edx, [esp + 0x84]
push edx
call fcn.005fba40
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x602950
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x602970
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00601e5a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x602993
test byte [esp + 8], 2
je 0x602993
call fcn.00601ecd
mov dword [eax], 0xd
call fcn.00601ed6
mov dword [eax], 5
jmp 0x60296c
xor eax, eax
ret

Function at 0x61558e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x6155c6
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.006135de
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.006135b6
jmp 0x6155d2
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x616d89
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x616dcb
call fcn.0061d4f8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x616dcb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x616dc2
xor eax, eax
jmp 0x616dd3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00616dd9
pop edi
pop esi
pop ebx
ret 4

Function at 0x61da28
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x61da56
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x61da74
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0061d98e
jmp 0x61da74
mov eax, dword [esi + 0x14]
test eax, eax
je 0x61da74
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0061d98e
test edi, edi
mov eax, edi
jne 0x61da5e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4246c3
Capabilities:
Encode data using xor

Disassembly:
wait
mov bh, 0x58
push edi
or word [edi], dx
sbb byte [ecx], dl
pop ebp
push edx
pop eax
mov dword [ebx + 0x57b996a9], edx
pop eax
push edi
cmp edx, dword [ebx + ebx]
adc eax, 0x555a553a
mov ebp, 0xbc929d92
push ebx
pop edi
push eax
aas
adc dword [esi], ebx
adc dword [ecx], esi
pop esi
push eax
pop edi
mov al, 0x9c
xchg ebx, eax
popfd
mov dl, 0x5a
imul esp, dword [esi + 0x38], 0x3b141817
push esp
pop ebx
push esp
mov ebx, 0xba959b94
push ebp
pop edx
push ebp
cmp dl, byte [0x523a151a]
pop ebp
push edx
mov ebp, 0xbd929d92
push edx
pop ebp
push ebx
cmp al, 0x13
sbb al, 0x13
cmp al, 0x50
pop edi
push eax
mov edi, 0xbe919f90
push ecx
pop esi
push ecx
xor dword [esi], ebx
adc dword [edi], ebx
pop ds
xor byte [ebp + 0x55], bl
pop ebx
mov bh, 0xa6
test eax, 0x5d55bb96
push eax
push ds
adc byte [0x57596636], bl
mov ebx, 0xbd959a94
push ebx
pop esp
push eax
xor dword [esi], ebx
adc dword [edi], ebx
xor byte [edi + 0x53], bl
pop edx
mov dword [edi + 0x54899b9a], edx
pop edx
push edx
cmp eax, 0x321e1d12
imul sp, word [esi - 0x43], 0x9d92
xchg edx, eax
mov ebp, 0x3f525d52
adc dword [ecx], edx
pop ds
xor byte [edx + 0x57], bl
pop eax
mov dword [esi + 0x54b89799], esp
pop ebx
push esp
cmp edx, dword [ebx + ebx]
adc al, 0x3a
push edx
pop esp
push eax
mov edi, 0xb49a959d
loopne 0x42472b
arpl bp, ax
add bl, dl
sub eax, 0x68a80cca
dec edi
xchg dword [esi - 0x60], esp
inc edi
and dword [edx + 0x2cea0dda], 0xffffffc8
imul ebp, dword [edx + 0x42]
test byte [esi - 0x60], ah
inc esp
mov ebp, 0xbcc68af
in al, dx
and al, 0xc3
add byte [edi + 0x6b8d3a62], ah
mov eax, dword [0x6ea88c7a]
iretd

Function at 0x45b24a
Capabilities:
Encode data using xor

Disassembly:
push edx
and al, 0xec
stc
push ebp
push cs
movsb byte es:[edi], byte [esi]
sub cl, byte [esi + 0x51546cd2]
cmpsb byte [esi], byte es:[edi]
dec esp
mov ah, 0xc7
sub dword [ecx + ebx*4], eax
xchg ecx, eax
xor esi, dword [eax]
push ss
mov cl, bl
sub dl, byte [esi - 0x4acb49b3]
rol dword [ecx - 0x15], cl
invalid
Function at 0x51aa91
Capabilities:
Accept command line arguments

Disassembly:
add byte [ebx], dh
adc al, 0x24
xor dword [esp], edx
xor edx, dword [esp]
pop esp
push dword [esp]
pop ebx
push ebp
mov dword [esp], edi
mov edi, esp
add edi, 4
add edi, 4
xor edi, dword [esp]
xor dword [esp], edi
xor edi, dword [esp]
pop esp
push dword [ebp - 0x10]
push dword [esp]
push dword [esp]
pop edx
add esp, 4
add esp, 4
jmp 0x503957
and al, byte [0x63004a]
jmp fcn.005603d1
push ecx
mov ecx, 0x17f03c29
push edi
mov edi, 0x17f02c29
xor ecx, edi
pop edi
push ebx
mov ebx, 0x7fdf6e93
add ebx, 0x7ffe0e20
neg ebx
xor ebx, 0x77c5e866
sub edx, ebx
pop ebx
add edx, 0x3c3fb077
add edx, ecx
sub edx, 0x3c3fb077
add edx, 0x77e76b2b
pop ecx
jmp 0x51e623
push edx
mov dword [esp], edi
mov dword [esp], eax
mov dword [esp], edx
mov dword [esp], ecx
add ecx, 0x3a370740
push edi
mov edi, 0x32eba79b
and edi, 0x6aeeef42
sub edi, 0x7abf10b3
not edi
not edi
sub edi, 0x783c35cd
add ecx, edi
pop edi
sub ecx, 0x7d972a18
add ecx, eax
add ecx, 0x7d972a18
sub ecx, 0x2fef6082
push eax
mov eax, 0x616b234e
neg eax
xor eax, 0xa4a3dbf2
sub ecx, eax
pop eax
mov ecx, dword [esp]
push ebp
mov ebp, esp
push edi
mov edi, 0x58ff609b
add edi, 0x77db2d85
inc edi
push ebx
mov ebx, 0x6b6ba1f4
shr ebx, 2
shr ebx, 2
not ebx
inc ebx
sub ebx, 0x7cffd1f4
xor ebx, 0x536c020e
add edi, ebx
pop ebx
add ebp, edi
pop edi
add ebp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
mov al, byte [0x63004d]
push 0x27c32d
mov dword [esp], edi
push ecx
mov ecx, 0x5b03ba5d
mov dword [esp + 4], ecx
pop ecx
mov dword [esp], ebp
mov dword [esp], edx
push 0x2ca89073
mov dword [esp], ecx
mov edx, dword [esp]
push edi
mov edi, esp
push esi
mov esi, 4
add edi, esi
pop esi
add edi, 4
xchg dword [esp], edi
pop esp
push dword [esp]
pop edx
push eax
mov eax, esp
add eax, 4
push ecx
mov ecx, 4
add eax, ecx
pop ecx
xor eax, dword [esp]
xor dword [esp], eax
xor eax, dword [esp]
pop esp
jmp 0x4c57e3
push edx
push esp
mov edx, dword [esp]
add esp, 4
add edx, 4
sub edx, 4
xchg dword [esp], edx
pop esp
mov dword [esp], edx
pop dword [ebp - 0x10]
jmp 0x51aa38

Function at 0x626c77
Capabilities:
Terminate process

Disassembly:
add dword [ebp + 5], esi
call fcn.00627cb8
push dword [esp + 4]
call fcn.00627cf1
pop ecx
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x627cf1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303c0
Function at 0x43ac70
Capabilities:
Encode data using xor

Disassembly:
push ecx
cdq
invalid
mov dl, 0xac
iretd
or esp, 0xffffffff
int1
jg 0x43ac4d
jg 0x43abdb
pop esi
loopne 0x43abbc
push dx
mov bh, 0xfd
sbb eax, 0xe0a8f150
invalid
loop 0x43abf4
cmp eax, 0x97c0a3c1
add al, bl
dec edi
and ebp, edi
cmp eax, 0xf0bc714b
push esp
and al, 0x6e
insd dword es:[edi], dx
pop ecx
push 0x14
jge 0x43acd9
jge 0x43acfb
insb byte es:[edi], dx
xor byte [edx + esi*4], bh
iretd
adc al, 0x80
mov dword [0x80560b03], eax
push es
mov bl, 0x5f
insb byte es:[edi], dx
sub al, 0x7c
pushfd
minps xmm6, xmm3
sub dl, byte [eax + 0x6d]
push eax
insd dword es:[edi], dx
push 0x1e2be09f
and al, 0xbc
push 0xc8030e9b
mov word [eax - 0x6d], es
xchg ebx, eax
push ecx
in eax, dx
test eax, 0xac1eb89e
xor bh, byte [eax - 0x73ad73f8]
mov word [edx - 0x74], ss
pop ebx
dec esp
or eax, 0x6f412841
aad 0x77
and al, byte [edx]
imul edi, dword [esi - 0x7f], 0xf45abb1c
or eax, 0x9f5f2d6a
inc ecx
inc ebx
mov dl, 0xf8
mov dl, 0x2d
lcall 0x1983, 0xe38c00c8
adc ah, byte [edi - 0x61]
sahf
jle 0x43aceb
pop esp
jg 0x43ad06
pop esp
sbb al, 0x8e
mov cl, 0x8e
pop esp
and dword [0x388fe38e], 0xfffffff3
imul ebx, dword [ebx + eax*8 + 8], 0xffffffed
mov eax, 0x579179e3
int 0x6d
arpl word [ecx + 0x51], cx
scasd eax, dword es:[edi]
mov dword [edi + 0x6ebc3531], ebp
pop ebp
pop esp
jge 0x43adbe
mov bh, al
mov al, byte [0x844dad40]
sbb byte [eax + 0x63d2e65], ch
in eax, dx
push ds
sub byte gs:[edx], bl
invalid
xchg esi, eax
test al, 2
cld
xchg ebx, eax
imul edi, dword [ecx], 0x4a18450d
movsd dword es:[edi], dword [esi]
inc ecx
cli
pop eax
retf 0x9b18

Function at 0x488d61
Capabilities:
Encode data using xor

Disassembly:
or edi, dword [edi]
sub dl, al
pushal
int 0xcc
push cs
add ebp, dword [ecx - 0xc]
imul edx, edx, 0xa3cb01b0
call 0xe5be43c5
jp 0x488d1d
sbb al, 0x1d
push 0x2f
xchg ecx, eax
in eax, 0x44
invalid
fstpnce st(3), st(0)
div cl
add al, 0x54
add byte [esp + eax*8 - 0x1f], al
movsd dword es:[edi], dword [esi]
xchg edi, eax
outsb dx, byte [esi]
aas
mov esp, 0x9c0320b
rol byte [ecx + 0x4c00167f], 0x63
or al, byte [ecx]
enter 0x5ae7, 0x6e
xor al, al
or eax, eax
cmp dword [edi + 0x16], 0xa634c00
add eax, ecx
out 0x5a, eax
outsb dx, byte [esi]
jae 0x488ce6
call 0x6502dd90
dec ebp
dec ebp
or dword [edi - 0x59], edi
xor esp, dword [edx + 0x17]
lahf
jnp 0x488d43
inc edx
sub byte [ebx], dh
sbb ch, byte [esi]
xor byte [ecx - 0x22b3c2df], 0x8b
int1
invalid
or ecx, dword [edx]
push ds
shr byte [esi], cl
cmp dword [ecx - 0x4aa5c63], 0x4e
xchg dword cs:[0x421ee1], ebx
xchg byte [eax + 0x74dce7cb], ch
test al, 0xcb
out 0xdc, eax
je 0x488db6
and esp, ecx
scasd eax, dword es:[edi]
Function at 0x627d31
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6313d0
cmp edx, dword [eax]
je 0x627d53
add eax, 8
inc ecx
cmp eax, 0x631460
jl 0x627d44
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6313d0]
jne 0x627e81
mov eax, dword [0x639d7c]
cmp eax, 1
je 0x627e5b
test eax, eax
jne 0x627d84
cmp dword [0x6312f8], 1
je 0x627e5b
add byte [eax], al
lea eax, [ebp + 8]
lea esi, [esi + 0x6313d4]
push 0
push eax
push dword [esi]
call fcn.00628ba0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x4024f7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [0x40a11c]
sbb al, 0xa1
inc eax
add byte [ebx + 0x40809c35], cl
add bh, bh
salc
test eax, eax
je 0x402528
mov eax, dword [0x40a118]
cmp eax, 0xffffffff
je 0x402528
push eax
push dword [0x40a11c]
call esi
call eax
test eax, eax
je 0x402528
mov eax, dword [eax + 0x1f8]
jmp 0x40254f
mov esi, str.KERNEL32.DLL
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x402543
push esi
call fcn.00401852
pop ecx
test eax, eax
je 0x40255b
push str.EncodePointer
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40255b
push dword [ebp + 8]
call eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x416a92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x416b67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x416b31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x416b5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00416b71
test eax, eax
je 0x416b67
add ebx, 0x14
jmp 0x416b3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x416b71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x416ddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x416ddd
mov eax, 1
test eax, eax
je 0x416ddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x416ddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x416dd3
mov ebx, eax
and eax, 0x80000000
jne 0x416d4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x416ddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x416ddd
mov eax, 1
test eax, eax
je 0x416ddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x416ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x416ca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x416ddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x416b67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x416ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x416ca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc
Function at 0x416e9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x416fee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x416fee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.00416ff8
test eax, eax
je 0x416fee
add ebx, 0x28
dec ecx
jne 0x416fc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x41709e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x4170c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x41712e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x4170e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x41712e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x417105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x41712e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x417123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x41712e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x41716b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10