joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2000e8e0
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0x410
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [esp + 0x418]
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push 3
push 0
push ecx
push 0x80000002
call dword [0x2001a0c8]
test eax, eax
je 0x2000e926
xor al, al
pop edi
add esp, 0x410
ret
push ebx
push ebp
lea edx, [esp + 0x10]
push esi
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x42c]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x2c], 0x400
mov byte [esp + 0x2b], 0
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
test eax, eax
jne 0x2000ea48
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x42c]
test eax, eax
lea esi, [esp + 0x20]
jbe 0x2000e9a6
mov ebx, dword [0x2001a394]
push ebp
push esi
call ebx
add esp, 8
test eax, eax
je 0x2000e9de
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0x14]
dec ecx
lea esi, [esi + ecx + 1]
mov ecx, esi
sub ecx, edx
cmp ecx, eax
jb 0x2000e97b
cmp dword [esp + 0x430], 1
jne 0x2000eab0
lea esi, [esp + eax + 0x1f]
push ebp
push esi
call dword [0x2001a2f0]
mov edi, dword [0x2001a2dc]
push esi
call edi
push esi
mov byte [eax + esi + 1], 0
call edi
mov edx, dword [esp + 0x14]
lea ecx, [edx + eax + 1]
jmp 0x2000ea88
mov eax, dword [esp + 0x430]
test eax, eax
jne 0x2000eab0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
or edx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x14]
mov edi, esi
not ecx
dec ecx
sub edx, ecx
or ecx, 0xffffffff
add eax, edx
mov dword [esp + 0x14], eax
sub eax, esi
lea eax, [esp + eax + 0x21]
push eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + esi + 1]
push ecx
push esi
call dword [0x2001a360]
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp ecx, 3
jae 0x2000ea8c
mov ecx, dword [esp + 0x428]
mov edx, dword [esp + 0x18]
push ecx
push edx
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
jmp 0x2000eaa9
cmp dword [esp + 0x430], 1
jne 0x2000eab0
mov edi, dword [esp + 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
inc ecx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x42c]
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.IMM32.dll_ImmGetContext]
test eax, eax
sete byte [esp + 0x13]
mov eax, dword [esp + 0x18]
push eax
call dword [0x2001a0ac]
mov al, byte [esp + 0x13]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x410
ret
Function at 0x2000f550
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [0x2001a128]
test eax, eax
je 0x2000f5c6
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ecx
push edx
push esi
call dword [0x2001a198]
test eax, eax
je 0x2000f5c6
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x2000f5c6
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x2000f5b4
mov edx, esi
cmp edi, ebx
jb 0x2000f5be
add edx, ebx
cmp edi, edx
jbe 0x2000f5d0
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x2000f5a6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
Function at 0x20010f50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x808
lea eax, [esp + 0x10c]
push ebx
push esi
push edi
push 0x104
push eax
call dword [0x2001a2bc]
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x20021800
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [0x2001a2e0]
lea edx, [esp + 0x14]
push edx
call dword [0x2001a2dc]
lea ebx, [esp + eax + 0x14]
mov eax, dword [0x20022210]
or ecx, 0xffffffff
push ebx
lea edi, [eax + 0x10]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.200033f0
mov edi, 0x20022c90
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x80
push 4
mov ecx, edx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x28]
push 2
rep movsb byte es:[edi], byte [esi]
push eax
call dword [0x2001a144]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x200110f1
mov esi, dword [0x20022210]
mov ecx, 0x17e
lea edi, [esp + 0x21c]
push 0
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x220]
call dword [0x2001a358]
push eax
call dword [0x2001a354]
mov edi, dword [0x2001a350]
add esp, 8
call edi
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
fmul qword [0x2001aad8]
call fcn.200196d0
test al, al
je 0x20011061
mov ecx, 0x5f8
mov dl, byte [esi]
xor dl, al
mov byte [esi], dl
inc esi
dec ecx
jne 0x2001107f
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x224]
push 0x5f8
push edx
push ebx
call dword [0x2001a160]
push ebx
call dword [0x2001a2f8]
mov edi, 0x20022c80
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call fcn.200158e0
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x808
ret
Function at 0x20011100
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2001abc8
push 0x20019680
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x20]
cmp eax, 3
ja case.default.0x20011137
jmp dword [eax*4 + 0x2001127c]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne case.default.0x20011137
lea ecx, [ebp - 0x24]
push ecx
push 0x2001f
push ebx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x2001a0c8]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne case.default.0x20011137
mov edx, dword [ebp + 0x14]
cmp edx, ebx
jbe case.default.0x20011137
cmp edx, 2
jbe 0x200111c3
cmp edx, 4
jne case.default.0x20011137
push edx
lea ecx, [ebp + 0x1c]
push ecx
push edx
push ebx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.IMM32.dll_ImmGetContext]
test eax, eax
jne case.default.0x20011137
jmp 0x20011247
mov esi, dword [ebp + 0x18]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push edx
push ebx
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.IMM32.dll_ImmGetContext]
test eax, eax
jne case.default.0x20011137
jmp 0x20011247
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push ebx
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x2001a0c8]
test eax, eax
jne case.default.0x20011137
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [0x2001a01c]
test eax, eax
jne case.default.0x20011137
jmp 0x20011247
lea edx, [ebp - 0x24]
push edx
push 0x2001f
push ebx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x2001a0c8]
test eax, eax
jne case.default.0x20011137
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
test eax, eax
jne case.default.0x20011137
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.2001126e
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x20012ee0
Capabilities:
Encode data using xor

Disassembly:
push esi
call fcn.2000c7a0
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
or eax, 0xffffffff
test esi, esi
jbe 0x20012f15
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x20023f80]
xor eax, edx
inc ecx
dec esi
jne 0x20012ef6
pop ebx
not eax
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x20012f31
push esi
push 0x200217fc
push eax
call dword [0x2001a4d8]
add esp, 0xc
mov eax, esi
pop esi
ret
Function at 0x20013710
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, 0x5f8
mov eax, esi
mov dl, byte [esi + 0xf]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ecx
jne 0x20013720
mov al, byte [esi]
mov cl, byte [esi + 0xe]
pop esi
cmp al, cl
pop ebx
jne 0x2001373c
cmp al, 0x2b
jne 0x2001373c
mov al, 1
ret
xor al, al
ret

Function at 0x200143d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 1
call fcn.20009a60
add esp, 8
nop
xor ecx, ecx
test eax, eax
jle 0x20014424
push ebx
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
add bl, 0x7a
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x5f
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x46
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x200143f3
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x20015710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x114
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
cmp ebx, ecx
push edi
je 0x2001581d
mov eax, dword [ebx + 0x3c]
mov ebp, dword [esp + 0x12c]
add eax, ebx
mov dword [esp + 0x10], ecx
mov esi, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add esi, ebx
mov dword [esp + 0x1c], eax
test ebp, 0x80000000
jne 0x200157bb
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
add eax, ebx
cmp edx, ecx
mov dword [esp + 0x18], ecx
jbe 0x200157d9
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
push 0
mov edi, dword [ecx]
add edi, ebx
push edi
call fcn.2000d8c0
add esp, 4
push eax
push edi
call fcn.20012ee0
and eax, 0x7fffffff
add esp, 0xc
cmp eax, ebp
je 0x200157a6
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x18]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
jb 0x20015763
jmp 0x200157d9
mov edx, dword [esi + 0x24]
mov eax, dword [esp + 0x18]
lea ecx, [edx + eax*2]
mov dx, word [ecx + ebx]
mov word [esp + 0x10], dx
jmp 0x200157d9
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov eax, ebp
add edx, ecx
and eax, 0xffff
cmp eax, edx
jae 0x2001581d
cmp eax, ecx
jb 0x2001581d
sub bp, cx
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x1c]
and eax, 0xffff
lea edx, [ecx + eax*4]
mov eax, dword [edx + ebx]
add eax, ebx
je 0x2001581f
cmp eax, esi
jb 0x2001581f
mov ecx, dword [esp + 0x1c]
add ecx, esi
cmp eax, ecx
jae 0x2001581f
mov dl, byte [eax]
xor ecx, ecx
test dl, dl
mov esi, eax
je 0x2001581d
lea edx, [esp + 0x20]
sub edx, eax
mov al, byte [esi]
inc ecx
mov byte [edx + esi], al
inc esi
cmp al, 0x2e
je 0x2001582a
cmp byte [esi], 0
jne 0x2001580d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
test ecx, ecx
jle 0x2001581d
mov byte [esp + ecx + 0x20], 0x64
inc ecx
mov al, 0x6c
lea edx, [esp + 0x20]
mov byte [esp + ecx + 0x20], al
inc ecx
push edx
mov byte [esp + ecx + 0x24], al
mov byte [esp + ecx + 0x25], 0
call fcn.20012500
add esp, 4
lea eax, [esp + 0x20]
push eax
call fcn.200083d0
push 0
push esi
mov edi, eax
call fcn.2000d8c0
add esp, 4
push eax
push esi
call fcn.20012ee0
and eax, 0x7fffffff
push eax
push edi
call fcn.20015710
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
Function at 0x49ea92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x49eb67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x49eb31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x49eb5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0049eb71
test eax, eax
je 0x49eb67
add ebx, 0x14
jmp 0x49eb3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x49eb71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x49eddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x49eddd
mov eax, 1
test eax, eax
je 0x49eddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x49eddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x49edd3
mov ebx, eax
and eax, 0x80000000
jne 0x49ed4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x49eddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x49eddd
mov eax, 1
test eax, eax
je 0x49eddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x49eddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x49eca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x49eddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x49eb67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x49eddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x49eca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc
Function at 0x49ee9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x49efee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x49efee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.0049eff8
test eax, eax
je 0x49efee
add ebx, 0x28
dec ecx
jne 0x49efc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x49f09e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x49f0c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x49f12e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x49f0e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x49f12e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x49f105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x49f12e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x49f123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x49f12e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x49f16b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10
Function at 0x49f172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x49f1a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x49f1a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x49fdff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.0049ff04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.0049ff20
push edx
push dword [ebp + 0x10]
push eax
call fcn.0049feec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0049ff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0049fecb
push ecx
push dword [ebp + 8]
call fcn.0049ff04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0049ff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0049fecb
push ecx
push dword [ebp + 8]
call fcn.0049ff04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0049ff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0049fecb
push ecx
push dword [ebp + 8]
call fcn.0049ff04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0049ff04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0049fecb
cmp ecx, 0x2b
jne 0x49fe0f
leave
ret 0xc

Function at 0x4a14b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x4a1544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x4ded0
push 0
call dword [eax + 0x20]
test eax, eax
je 0x4a15d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x4ded0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x4ded0
call fcn.004a13fa
push 0x4ded0
push dword [ebp + 0xc]
call fcn.0049f1a8
test eax, eax
jne 0x4a15b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x4ded0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.004a15dd
test eax, eax
je 0x4a15d6
jmp 0x4a1574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x4a15d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x4a160b
Capabilities:
Terminate process

Disassembly:
call fcn.004a1618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x407d61
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4bc534]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00407ca0
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004088d0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x407db0
cmp dword [ebp - 0x1c], 5
jb 0x407dc8
jmp 0x407dc4
cmp dword [ebp - 0x10], 1
jne 0x407dc8
cmp dword [ebp - 0x1c], 4
ja 0x407dc4
jne 0x407dc8
cmp dword [ebp - 0x18], 0
jbe 0x407dc8
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4ad2fc
call fcn.00407b36
test eax, eax
jge 0x407de9
mov byte [0x4c07a0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00408023
add ebp, 0x78
leave
ret

Function at 0x408023
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bc534]
jne 0x40802d
repz ret
jmp fcn.0040dbc1