joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49afca
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
jle 0x49aff3
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x537910]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [esp + 8]
cmp dword [esp + 8], 0
jg 0x49afd3
pop esi
ret

Function at 0x49ba3f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x576730]
sub esp, 0x310
push ebx
push esi
test eax, eax
je 0x49ba6f
push eax
push 0x544148
lea eax, [ebp - 0x108]
push eax
push 0xe6
call fcn.00499f5b
add esp, 0x10
jmp 0x49badd
call fcn.0049b294
mov esi, 0xe6
test eax, eax
je 0x49baa5
lea eax, [ebp - 0x310]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x310]
push eax
call fcn.0049b32d
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x49bac1
push 7
pop eax
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x210]
push eax
call fcn.0049b3ee
jmp 0x49ba97
push ebx
push 0x544148
lea eax, [ebp - 0x108]
push eax
push esi
call fcn.00499f5b
push ebx
call fcn.004ea208
add esp, 0x14
lea ecx, [ebp - 0x108]
call fcn.0049a63b
test eax, eax
jbe 0x49baf6
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x49baf6
dec eax
jne 0x49baed
mov byte [ebp + eax - 0x108], 0
lea eax, [ebp - 0x108]
push eax
push str._setilqs_
push edi
push 0xe7
call fcn.00499f5b
mov ecx, edi
call fcn.0049a63b
mov esi, eax
lea eax, [esi + edi]
push eax
push 0x14
call fcn.0049a086
add esp, 0x18
push 0x14
pop ecx
movzx eax, byte [esi + edi]
xor edx, edx
push 0x3e
pop ebx
div ebx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [esi + edi], al
inc esi
dec ecx
jne 0x49bb2f
mov byte [esi + edi], cl
xor eax, eax
jmp 0x49baa1

Function at 0x49bec6
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
lea eax, [ebp - 0x110]
push eax
push 0x104
push dword [ebp + 0xc]
mov dword [ebp - 8], 0x200
push dword [ebp + 8]
call fcn.0049bdee
add esp, 0x10
test eax, eax
jne 0x49bf84
lea eax, [ebp - 0x110]
push eax
call fcn.0049ba08
mov esi, eax
xor ebx, ebx
pop ecx
cmp esi, ebx
je 0x49bf7d
call fcn.0049b294
test eax, eax
mov eax, esi
je 0x49bf4a
cmp word [esi], bx
je 0x49bf34
cmp word [eax], 0x5c
je 0x49bf2f
inc eax
inc eax
cmp word [eax], bx
jne 0x49bf20
jmp 0x49bf34
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 4]
push eax
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x49bf70
cmp byte [esi], bl
je 0x49bf5c
cmp byte [eax], 0x5c
je 0x49bf5a
inc eax
cmp byte [eax], bl
jne 0x49bf4e
jmp 0x49bf5c
mov byte [eax], bl
lea eax, [ebp - 4]
push eax
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.004ea208
pop ecx
cmp edi, ebx
jne 0x49bf84
mov dword [ebp - 8], 0x200
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b0f7f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x4b0f97
xor eax, eax
jmp 0x4b1081
mov esi, dword [ebp + 8]
push 0x44
call fcn.00498fad
mov esi, eax
pop ecx
test esi, esi
je 0x4b0f90
push dword [ebp + 0x10]
mov ebx, dword [edi]
push dword [ebp + 8]
call fcn.004b0cf4
push dword [ebp + 0x10]
mov dword [esi], eax
push dword [edi + 8]
push dword [ebp + 8]
call fcn.004b0dc0
add esp, 0x14
push 0
push dword [ebp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push eax
push dword [ebp + 8]
call fcn.004b0a7c
push dword [ebp + 0x10]
mov dword [esi + 0xc], eax
push dword [ebp + 8]
mov ebx, dword [edi + 0x10]
call fcn.004b0cf4
push 0
push dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
push eax
push dword [ebp + 8]
call fcn.004b0a7c
push dword [ebp + 0x10]
mov dword [esi + 0x14], eax
push dword [ebp + 8]
mov ebx, dword [edi + 0x18]
call fcn.004b0cf4
push dword [ebp + 0x10]
mov dword [esi + 0x18], eax
mov al, byte [edi + 4]
mov byte [esi + 4], al
push dword [edi + 0x1c]
push dword [ebp + 8]
call fcn.004b0f7f
add esp, 0x3c
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x28]
push eax
push dword [ebp + 8]
call fcn.004b0a7c
push ebx
push dword [ebp + 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
push eax
push dword [ebp + 8]
call fcn.004b0a7c
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov ax, word [edi + 6]
or dword [esi + 0x38], 0xffffffff
or dword [esi + 0x3c], 0xffffffff
mov ecx, 0xfff7
and ax, cx
add esp, 0x20
or dword [esi + 0x40], 0xffffffff
mov word [esi + 6], ax
mov dword [esi + 0x24], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ce2e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
movzx eax, word [ebp + 8]
push 0x536fb4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
lea esi, [ebp - 8]
mov edi, eax
call fcn.00401fed
cmp dword [ebp - 8], ebx
je 0x4ce345
test edi, edi
je 0x4ce345
lea ecx, [ebp - 0x1c]
mov eax, esi
call fcn.00435802
push dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x10]
mov ebx, eax
lea eax, [ebp - 8]
call fcn.0042e22a
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x4ce3d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x51f7c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x567570]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x10]
push ecx
call fcn.004d4fe0
mov esi, eax
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
sub esp, 0xc
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [eax + 8], edx
lea edx, [esp + 0x1c]
mov dword [eax + 0xc], ecx
push edx
mov ecx, 0x56eed8
mov dword [esp + 0x44], 0
call fcn.004d2230
push esi
push eax
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x3c], 1
call fcn.0040eb6f
add esp, 0xc
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x30], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ce483
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x30], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ce4a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 8]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.0040157b
add eax, 0x10
mov dword [esi], eax
mov esi, dword [esp + 0x40]
add esp, 4
push esi
call fcn.004d4d10
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
add esp, 8
mov dword [esp + 0x30], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ce4f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x4d3c20
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x567570]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x1a
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d3c72
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.00401f01
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004ee5a2
add esp, 0x210
ret 4
Function at 0x4d5180
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
sub esp, 8
push ebx
push esi
mov dword [esp + 0xc], 0
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
pushal
mov ebx, dword fs:[0x18]
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xa8]
mov eax, dword [eax + 0xa4]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
popal
mov eax, dword [esp + 0x10]
cmp eax, 5
jne 0x4d522b
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4d51eb
mov esi, dword [esp + 0x18]
push str.Windows_2000
mov ecx, esi
call fcn.00401f01
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp eax, 1
jne 0x4d5209
mov esi, dword [esp + 0x18]
push str.Windows_XP
mov ecx, esi
call fcn.00401f01
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp eax, 2
jne 0x4d52ab
mov esi, dword [esp + 0x18]
push str.Windows_2003
mov ecx, esi
call fcn.00401f01
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp eax, 6
jne 0x4d52ab
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4d5251
mov esi, dword [esp + 0x18]
push str.Windows_Vista
mov ecx, esi
call fcn.00401f01
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp eax, 1
jne 0x4d526f
mov esi, dword [esp + 0x18]
push str.Windows_Win7
mov ecx, esi
call fcn.00401f01
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp eax, 2
jne 0x4d528d
mov esi, dword [esp + 0x18]
push str.Windows_Win8
mov ecx, esi
call fcn.00401f01
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp eax, 3
jne 0x4d52ab
mov esi, dword [esp + 0x18]
push str.Windows_Win8.1
mov ecx, esi
call fcn.00401f01
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret
mov esi, dword [esp + 0x18]
push str.Windows_Unknown
mov ecx, esi
call fcn.00401f01
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4d5340
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5205c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x567570]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0
call fcn.004d4fc0
mov esi, eax
push 0x56eefc
lea ecx, [esp + 0x18]
push str.CT:_PC_r_nCV:
push ecx
mov dword [esp + 0x30], 0
call fcn.0040ebcd
push str._r_nCI:
push eax
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x3c], 1
call fcn.0041217d
push esi
push eax
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x48], 2
call fcn.0040eb6f
mov esi, dword [esp + 0x50]
push 0x53f4c8
push eax
push esi
mov byte [esp + 0x54], 3
call fcn.0041217d
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
add esp, 0x34
mov byte [esp + 0x20], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d53f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x20], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d541c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x20], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d5441
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d5469
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret

Function at 0x4d5bb0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x520738
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x567570]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
lea eax, [esp + 8]
push eax
mov ecx, 0x56ef04
call fcn.004d3c20
push str.iAppleuploadusingLog.ini
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x20], 0
call fcn.0041217d
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4d5c26
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d5c4e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret
Function at 0x4d9639
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test eax, eax
je 0x4d966e
push edi
mov edi, 0xf0
cmp dword [esp + 0x10], edi
jae 0x4d9661
push eax
call fcn.004e18c8
push 2
call fcn.004e18b7
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.004ee670
add esp, 0xc
pop edi
pop esi
ret
Function at 0x4db264
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
push dword [ebp + 0x1c]
inc edi
xor ebx, ebx
mov dword [ebp - 8], ebx
push edi
call fcn.004e17c9
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
jne 0x4db295
xor eax, eax
jmp 0x4db421
mov ecx, dword [ebp - 4]
mov eax, 0xf4240
push 0x40
mov dword [ecx + 0x258], eax
mov ecx, dword [ebp - 4]
push fcn.004f043c
push dword [ebp - 4]
mov dword [ecx + 0x25c], eax
call fcn.004da789
push ebx
push eax
call fcn.004f2fa0
add esp, 0x14
test eax, eax
je 0x4db2d0
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.004e1890
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004da7c4
mov esi, dword [ebp + 8]
add esp, 0x20
cmp esi, ebx
je 0x4db329
xor edi, edi
push ebx
call fcn.004d9a7d
pop ecx
mov cl, byte [edi + esi]
cmp cl, byte [eax + edi]
je 0x4db317
mov eax, dword [ebp - 4]
or dword [eax + 0x70], 0x20000
push ebx
call fcn.004d9a7d
mov al, byte [eax + edi]
inc edi
pop ecx
test al, al
jne 0x4db2fe
xor edi, edi
inc edi
mov eax, dword [ebp - 4]
test dword [eax + 0x70], 0x20000
je 0x4db393
cmp esi, ebx
je 0x4db390
push ebx
call fcn.004d9a7d
pop ecx
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x4db365
cmp cl, 0x31
jne 0x4db35a
push ebx
call fcn.004d9a7d
pop ecx
mov cl, byte [esi + 2]
cmp cl, byte [eax + 2]
jne 0x4db365
cmp byte [esi], 0x30
jne 0x4db393
cmp byte [esi + 2], 0x39
jge 0x4db393
cmp esi, ebx
je 0x4db390
push ebx
call fcn.004d9a7d
push eax
push esi
push str.Application_built_with_libpng__.20s_but_running_with__.20s
lea eax, [ebp - 0x58]
push 0x50
push eax
call fcn.004ec8be
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 4]
call fcn.004da7e2
add esp, 0x20
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4db3d1
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.004e1945
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], ebx
jne 0x4db3d1
mov dword [ebp - 8], edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x4db408
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.004e191b
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov dword [eax + 0xb0], ebx
push dword [ebp - 4]
call fcn.004e1828
add esp, 0x14
jmp 0x4db28e
push ebx
push ebx
push ebx
push dword [ebp - 4]
call fcn.004e4ac8
mov esi, dword [ebp - 4]
add esp, 0x10
call fcn.004db20d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4de908
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov cl, byte [eax + 8]
sub esp, 0x14
cmp cl, 3
je 0x4dea8c
mov edx, dword [eax]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
mov dword [ebp + 8], edi
test cl, 2
je 0x4de958
movzx ecx, byte [eax + 9]
movzx edi, byte [esi]
mov ebx, ecx
sub ebx, edi
movzx edi, byte [esi + 1]
mov dword [ebp - 0x14], ebx
mov ebx, ecx
sub ebx, edi
movzx edi, byte [esi + 2]
sub ecx, edi
push 3
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
pop ebx
xor edi, edi
jmp 0x4de968
movzx ecx, byte [esi + 3]
movzx ebx, byte [eax + 9]
sub ebx, ecx
mov dword [ebp - 0x14], ebx
xor ebx, ebx
inc ebx
test byte [eax + 8], 4
je 0x4de97d
movzx ecx, byte [esi + 4]
movzx esi, byte [eax + 9]
sub esi, ecx
mov dword [ebp + ebx*4 - 0x14], esi
inc ebx
xor esi, esi
cmp ebx, edi
jle 0x4dea89
lea ecx, [ebp + esi*4 - 0x14]
cmp dword [ecx], edi
jg 0x4de993
mov dword [ecx], edi
jmp 0x4de99a
mov dword [ebp + 8], 1
inc esi
cmp esi, ebx
jl 0x4de987
cmp word [ebp + 8], di
je 0x4dea89
movzx ecx, byte [eax + 9]
dec ecx
dec ecx
je 0x4dea72
dec ecx
dec ecx
je 0x4dea43
sub ecx, 4
je 0x4dea21
sub ecx, 8
jne 0x4dea89
mov esi, dword [ebp + 0xc]
imul edx, ebx
mov dword [ebp - 4], edx
mov dword [ebp + 8], edi
cmp edx, edi
jbe 0x4dea89
mov eax, dword [ebp + 8]
xor edx, edx
div ebx
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
lea edi, [esi + 1]
movzx cx, byte [edi]
add ax, cx
mov cx, word [ebp + edx*4 - 0x14]
shr ax, cl
movzx eax, ax
mov ecx, eax
shr ecx, 8
mov byte [esi], cl
mov esi, edi
mov byte [esi], al
inc esi
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x4de9df
jmp 0x4dea89
mov esi, dword [ebp + 0xc]
imul edx, ebx
mov dword [ebp + 8], edx
cmp edx, edi
jbe 0x4dea89
xor edx, edx
mov eax, edi
div ebx
mov cl, byte [ebp + edx*4 - 0x14]
shr byte [esi], cl
inc esi
inc edi
cmp edi, dword [ebp + 8]
jb 0x4dea2e
jmp 0x4dea89
mov edi, dword [eax + 4]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
mov edx, 0xf0
sar edx, cl
push 0xf
pop eax
sar eax, cl
and dl, 0xf0
or dl, al
test edi, edi
jbe 0x4dea89
mov al, byte [esi]
mov cl, byte [ebp - 0x14]
shr al, cl
and al, dl
mov byte [esi], al
inc esi
dec edi
jne 0x4dea61
jmp 0x4dea89
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0xc]
cmp eax, edi
jbe 0x4dea89
mov dl, byte [ecx]
shr dl, 1
and dl, 0x55
mov byte [ecx], dl
inc ecx
dec eax
jne 0x4dea7c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4e8d07
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x56f188], 0
push esi
jne 0x4e8c7a
call fcn.004e8ba0
test eax, eax
je 0x4e8cbd
mov eax, dword [0x56f188]
cmp eax, 1
jne 0x4e8c9b
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4e8cbd
pop esi
ret
push eax
call dword [0x56f190]
test eax, eax
jne 0x4e8d05
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4e8cc1
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x56f188]
call dword [0x56f190]
mov edi, eax
test edi, edi
je 0x4e8ce6
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4e8d02
mov edi, esi
add esi, 0xff0
push edi
push dword [0x56f188]
call dword [0x56f18c]
add edi, 0x10
cmp edi, esi
jb 0x4e8cee
mov eax, edi
pop edi
pop esi
ret
jmp 0x4e8c67

Function at 0x4ee5a2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x567570]
jne 0x4ee5ac
repz ret
jmp fcn.004ff45c

Function at 0x507112
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004f4b7a
and dword [ebp - 4], 0
cmp dword [0x56fd90], 0
mov ebx, eax
jne 0x5071c3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x507274
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x507274
push eax
call fcn.004f4b08
mov dword [esp], 0x533c58
push edi
mov dword [0x56fd90], eax
call esi
push eax
call fcn.004f4b08
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x56fd94], eax
call esi
push eax
call fcn.004f4b08
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x56fd98], eax
call esi
push eax
call fcn.004f4b08
pop ecx
mov dword [0x56fda0], eax
test eax, eax
je 0x5071c3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004f4b08
pop ecx
mov dword [0x56fd9c], eax
mov eax, dword [0x56fd9c]
cmp eax, ebx
je 0x50721b
cmp dword [0x56fda0], ebx
je 0x50721b
push eax
call fcn.004f4b83
push dword [0x56fda0]
mov esi, eax
call fcn.004f4b83
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x50721b
test edi, edi
je 0x50721b
call esi
test eax, eax
je 0x507212
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x507212
test byte [ebp - 0xc], 1
jne 0x50721b
or dword [ebp + 0x10], 0x200000
jmp 0x507254
mov eax, dword [0x56fd94]
cmp eax, ebx
je 0x507254
push eax
call fcn.004f4b83
pop ecx
test eax, eax
je 0x507254
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x507254
mov eax, dword [0x56fd98]
cmp eax, ebx
je 0x507254
push eax
call fcn.004f4b83
pop ecx
test eax, eax
je 0x507254
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x56fd90]
call fcn.004f4b83
pop ecx
test eax, eax
je 0x507274
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x507276
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x50c3c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x50c431
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x50c431
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x50c41a
jmp 0x50c431
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x69f63c9f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3e1d660e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
popal
nop
nop
nop
nop
nop
jmp 0x431219