joyce8/EMBER2024-capa huggingface dataset:
Function at 0x569fdd
Capabilities:
Get file system object information

Disassembly:
push 0x274
mov eax, 0x5f7f7d
call fcn.005c9344
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00409391
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
push 0
push 0x630c1c
call fcn.00409075
cmp eax, 0xffffffff
jne 0x56a0b8
push 0
push 0x608bf4
lea ecx, [ebp - 0x278]
call fcn.00409075
cmp eax, 0xffffffff
jne 0x56a0b8
push 0
push 0x5fff48
lea ecx, [ebp - 0x278]
call fcn.00409075
cmp eax, 0xffffffff
jne 0x56a0b8
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00409391
add eax, 0x10
pop ecx
mov dword [ebp - 0x280], eax
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x114]
push ecx
push 0x104
push edx
push eax
lea edi, [eax - 0x10]
push edx
mov dword [ebp - 0x27c], edi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x56a087
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x5fdad8]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x27c]
mov edi, eax
call fcn.00402ac8
jmp 0x56a0f1
lea eax, [ebp - 0x114]
push eax
call fcn.005da3a0
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.0040376b
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00402ac8
mov esi, dword [ebp - 0x278]
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x56a0de
mov edi, dword [ebp - 0x274]
jmp 0x56a0f1
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x5fdad8]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00402ac8
mov eax, edi
call fcn.005c92f3
ret

Function at 0x57067f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x65d61c], 0
push esi
push edi
je 0x570706
cmp dword [0x65d948], 0xfffffffe
jne 0x5706f3
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x570706
mov edi, 0x66808c
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x6680a4], 0
jne 0x57070a
push 0
push 0
push 0x570710
call fcn.005d9cc4
add esp, 0xc
mov dword [0x6680a4], eax
test eax, eax
je 0x5706e3
cmp eax, 0xffffffff
je 0x5706e3
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [0x65d948], esi
jmp 0x5706ea
and dword [0x6680a4], 0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x570706
mov eax, dword [ebp + 8]
mov dword [0x65d948], eax
inc eax
neg eax
sbb eax, eax
and dword [0x6680a4], eax
pop edi
pop esi
pop ebp
ret
call fcn.00483e4b
int3
Function at 0x583c58
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.005dc760
pop ecx
test eax, eax
jne 0x583c9a
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00401bca
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x583c60
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret

Function at 0x5c9cc5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5c9d04
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5c9d04
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5c9d04
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5c9d04
cmp dword [ecx + 0x74], 0xe
jbe 0x5c9d04
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x5e0f48
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x62b0a0
push 0x62b098
push str.FlsAlloc
push 0x1f
call fcn.005e0dc7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5e0f7c
push dword [ebp + 8]
mov ecx, esi
call dword [0x5fdad8]
call esi
jmp 0x5e0f82
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x5e0fc6
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x62b0b0
push 0x62b0a8
push str.FlsGetValue
push 0x21
call fcn.005e0dc7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5e0ffd
push dword [ebp + 8]
mov ecx, esi
call dword [0x5fdad8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x5e1005
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x62b0b8
push 0x62b0b0
push str.FlsSetValue
push 0x22
call fcn.005e0dc7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5e103f
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5fdad8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x5e42b1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x6687b0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x5e42f1
cmp byte [ebx], 0xa
jne 0x5e42f1
or byte [edi + eax + 0x28], 4
jmp 0x5e42f6
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x5e43f5
mov dl, byte [eax]
cmp dl, 0x1a
je 0x5e43d8
inc eax
cmp dl, 0xd
je 0x5e4322
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x5e4348
cmp eax, ecx
jae 0x5e4356
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x5e430a
jmp 0x5e43f5
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5e43d3
cmp dword [ebp - 0x10], 0
je 0x5e43d3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x6687b0]
test byte [eax + edi + 0x28], 0x48
je 0x5e43ad
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x5e4398
mov byte [esi], dl
jmp 0x5e43a9
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x6687b0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x5e43f5
cmp byte [ebp - 1], 0xa
jne 0x5e43bc
cmp esi, ebx
jne 0x5e43bc
mov byte [esi], 0xa
jmp 0x5e43f4
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.005e4d00
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x5e43f5
mov byte [esi], 0xd
jmp 0x5e43f4
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x6687b0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x5e43f2
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x5e43f5
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x5e43fe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x6687b0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x5e4444
cmp word [ebx], dx
jne 0x5e4444
or byte [eax + edi + 0x28], 4
jmp 0x5e4449
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x5e45ac
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x5e458c
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x5e448a
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x5e44c0
cmp eax, edx
jae 0x5e44ce
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x5e4465
jmp 0x5e45ac
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5e4587
cmp dword [ebp - 0x18], 0
je 0x5e4587
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x6687b0]
test byte [eax + edi + 0x28], 0x48
je 0x5e455d
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x5e4521
mov word [esi], cx
jmp 0x5e4558
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x6687b0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x6687b0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x6687b0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x5e45ac
pop eax
cmp word [ebp - 4], ax
jne 0x5e456d
cmp esi, ebx
jne 0x5e456d
mov word [esi], ax
jmp 0x5e45a9
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.005e4d00
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x5e45ac
push 0xd
pop eax
jmp 0x5e4568
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x6687b0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x5e45a6
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x5e45ac
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x5e65bd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x5e665a
push ebx
push esi
call fcn.005e6586
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.005e3531
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5e6607
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5e6659
push edi
push eax
call fcn.005def12
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5e6627
call fcn.005deed8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5e6658
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.005e3531
add esp, 0x20
test eax, eax
jne 0x5e6646
push edi
call fcn.005deed8
jmp 0x5e664e
push ebx
call fcn.005deed8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5e665d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x5e666e
pop esi
ret
push ebx
push edi
push esi
call fcn.005e6586
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.005def12
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x5e6696
push ebx
push esi
push edi
call fcn.005cadb0
add esp, 0xc
push 0
call fcn.005deed8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x5e6a66
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005e66ab
Function at 0x5ec10b
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.005ec087
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x5ec27a
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x5ec27a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x5ec22f
jg 0x5ec167
test eax, eax
je 0x5ec225
push 1
push 0x1000
call fcn.005e04b9
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x5ec18a
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x5ec21c
push 0x8000
push ebx
call fcn.005de589
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x5ec1b3
jg 0x5ec1ae
cmp ecx, 0x1000
jb 0x5ec1b3
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.005e4095
add esp, 0x10
cmp eax, 0xffffffff
je 0x5ec1f8
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x5ec1ae
jl 0x5ec1df
test ecx, ecx
jne 0x5ec1a0
push dword [ebp - 0xc]
push ebx
call fcn.005de589
push esi
call fcn.005deed8
add esp, 0xc
xor ebx, ebx
jmp 0x5ec288
cmp byte [edi + 0x24], 0
je 0x5ec20f
cmp dword [edi + 0x20], 5
jne 0x5ec20f
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x5ec21a
mov ebx, dword [edi + 0x18]
jmp 0x5ec21c
xor ebx, ebx
push esi
call fcn.005deed8
pop ecx
jmp 0x5ec288
test ecx, ecx
jg 0x5ec1f1
jl 0x5ec22f
test eax, eax
jae 0x5ec1f1
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005e4d00
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x5ec24f
cmp byte [edi + 0x1c], 0
je 0x5ec1f1
jmp 0x5ec280
push ebx
call fcn.005dd32e
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x5ec1f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x5ec288
cmp byte [edi + 0x1c], 0
je 0x5ec285
mov ebx, dword [edi + 0x18]
jmp 0x5ec288
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.005e4d00
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5eca60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5eca8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5eca8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x439a92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x439b67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x439b31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x439b5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00439b71
test eax, eax
je 0x439b67
add ebx, 0x14
jmp 0x439b3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x439b71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x439ddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x439ddd
mov eax, 1
test eax, eax
je 0x439ddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x439ddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x439dd3
mov ebx, eax
and eax, 0x80000000
jne 0x439d4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x439ddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x439ddd
mov eax, 1
test eax, eax
je 0x439ddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x439ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x439ca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x439ddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x439b67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x439ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x439ca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc
Function at 0x439e9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x439fee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x439fee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.00439ff8
test eax, eax
je 0x439fee
add ebx, 0x28
dec ecx
jne 0x439fc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x43a09e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x43a0c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x43a12e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x43a0e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x43a12e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x43a105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x43a12e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x43a123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x43a12e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x43a16b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10