joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e7a3b00
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a3a99
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a3ab7
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a3b15
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a3afc
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a3b05
invalid
add al, 0x80
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a3b0f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a3af1
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1e7a3a7b
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1e7a3b62
dec eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1e7a3bb1
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1e7a3b31
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1e7a33c2
adc ebx, 0x75ff16d5
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x1e7a3bbd
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1e7a4080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x1e7a40b6
cmp dword [ebp - 0x398], 0
je 0x1e7a4280
cmp dword [ebp + 0xc], 1
je 0x1e7a4280
cmp dword [ebp + 0xc], 8
jne 0x1e7a4248
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
invalid
invalid
dec esp
stc
Function at 0x1e7a42a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
ror byte [ebp - 0x50243], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call sym.pywintypes27.dll_public:_static_int___cdecl_PyDEVMODEA::set_FormName_struct__object___struct__object___void__
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
push dword [eax]
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5

Function at 0x1e7a42d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
ror byte [ebp - 0x50243], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call sym.pywintypes27.dll_public:_static_int___cdecl_PyDEVMODEA::set_FormName_struct__object___struct__object___void__
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
push dword [eax]
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
Function at 0x1e7a47e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x1e7a4818
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
test byte [0xfffffc6c], al
test byte [0xfffffc6c], al
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x1e7a47c2
call fcn.1e7a33c2
in eax, dx
cmp bl, byte [eax - 0x6b]
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.1e7a33c2
or al, 0x10
lodsb al, byte [esi]
loopne 0x1e7a483d
test esp, edx
clc
invalid

Function at 0x1e7a50b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [ebx]
jne 0x1e7a514c
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
cmp dword [ebp - 0x6fc], 4
jne 0x1e7a51f6
and byte [ebp - 0x7bc], 0
and byte [ebp - 0x7bb], 0
mov byte [ebp - 0x7ba], 2
and byte [ebp - 0x7b9], 0
mov byte [ebp - 0x7b8], 0xa1
mov byte [ebp - 0x7b7], 0xb2
invalid
push dword [edx - 0x7b57a3a]
invalid
push dword [ecx - 0x7b47a3a]
invalid
invalid
mov eax, 0xf84c85c6
invalid
dec edi
mov byte [ebp - 0x7b3], 0xce
mov byte [ebp - 0x7b2], 0xd3
mov byte [ebp - 0x7b1], 0x99
mov byte [ebp - 0x7b0], 0x91
mov byte [ebp - 0x7af], 0x91
invalid
test dword [edx - 8], edx
invalid

Function at 0x1e7a5560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, 0x60
mov ebp, esp
add ebp, 0x24
push esp
call fcn.1e7a33c2
fisttp qword [0xa1644055]
inc eax
mov eax, dword fs:[0x30]
Function at 0x1e7a5570
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
inc eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x1e7a5586
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.1e7a33c2
and edi, dword [ebx + 5]
lodsb al, byte [esi]
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.1e7a33c2
sub ecx, dword [eax + 1]
push eax
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x1e7a55af
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x1e7a55af
call fcn.1e7a33c2
add dword ss:[eax + 0x245a8ba9], 0x8b66df03
test eax, 0x3245a8b
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.1e7a33c2
test eax, 0xff5bcfa0
jne 0x1e7a55f9
fcomp st(5)
invalid
push dword [ebp + 4]
push dword [ebp]
call fcn.1e7a3bc2
add al, 0x78
in eax, 0xff
inc dword [eax + edi*2]
sahf
jnp 0x1e7a561f
je 0x1e7a55e6
mov eax, dword [sym.imp.python27.dll_PyExc_TypeError]
mov ecx, dword [eax]
push str.The_object_is_not_a_PyOVERLAPPED_object
push ecx
call dword [sym.imp.python27.dll_PyErr_SetString]
add esp, 8
xor eax, eax
ret
stc
mov ecx, dword [esp + 8]
add eax, 0xc
mov dword [ecx], eax
mov eax, 1
ret

Function at 0x1e7a7500
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 4], 0x1e7ba2c0
je 0x1e7a751c
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
ret 8
mov eax, dword [eax + 8]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [esp + 8]
cmp ecx, 2
jne 0x1e7a7541
test eax, eax
je 0x1e7a754a
mov eax, dword [sym.imp.python27.dll__Py_TrueStruct]
inc dword [eax]
ret 8
cmp ecx, 3
jne 0x1e7a7554
test eax, eax
je 0x1e7a7537
mov eax, dword [sym.imp.python27.dll__Py_ZeroStruct]
inc dword [eax]
ret 8
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
ret 8
Function at 0x420e51
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x110
mov eax, 0x462354
call fcn.0043a790
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c], eax
call fcn.00420e33
mov ebx, eax
test ebx, ebx
je 0x420f3f
mov esi, dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push dword [edi + 0x38]
call esi
test eax, eax
jne 0x420ef7
push str.cannot_load_resource
lea ecx, [ebp - 0x2c]
call fcn.004069c2
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x68]
mov ecx, edi
push eax
call fcn.00420d75
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 5
call fcn.00417432
push str.System_error
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x84]
call fcn.0042b099
mov edx, eax
push 0x46
push str.Resource::getPtr
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x78]
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_jdk8u361_3183_install_src_windows_common_Resources.cpp
jmp 0x420fac
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [edi + 0x34], 6
mov esi, eax
jne 0x420f26
mov ecx, dword [edi + 0x18]
and ecx, 0xf
jbe 0x420f1c
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x420f0e
movzx eax, word [esi]
add eax, eax
add esi, 2
jmp 0x420f30
push ebx
push dword [edi + 0x38]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x6c]
mov dword [ecx], eax
mov eax, esi
call fcn.0043a73a
ret 4
push str.cannot_find_resource
lea ecx, [ebp - 0x2c]
call fcn.004069c2
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x68]
mov ecx, edi
push eax
call fcn.00420d75
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 1
call fcn.00417432
push str.System_error
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [sym.imp.KERNEL32.dll_FindResourceA]
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x78]
call fcn.0042b099
mov edx, eax
push 0x41
push str.Resource::getPtr
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x84]
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_jdk8u361_3183_install_src_windows_common_Resources.cpp
call fcn.00404614
push eax
lea ecx, [ebp - 0x50]
call fcn.0041ec53
lea eax, [ebp - 0x50]
mov dword [esp], 0x4891ac
push eax
call fcn.0043db4d
int3

Function at 0x4241e5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0043c400
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
sete al
leave
ret

Function at 0x425c7e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 0x10
jb 0x425c86
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
ret
Function at 0x425c94
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 0x10
jb 0x425c9c
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x425caf
test al, 0x10
je 0x425caf
mov al, 1
ret
xor al, al
ret

Function at 0x425f8e
Capabilities:
Get file version info

Disassembly:
push 0xe8
mov eax, 0x463155
call fcn.0043a790
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44], esi
push eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00407be2
lea edi, [esi + 0x18]
mov dword [ebp - 4], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [ebp - 4], 1
mov eax, esi
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x3c], ebx
jb 0x425fd5
mov eax, dword [esi]
mov ebx, dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
lea ecx, [ebp - 0x3c]
push ecx
push eax
call ebx
test eax, eax
je 0x42609a
push edi
push eax
mov ecx, edi
call fcn.00414ee1
mov eax, dword [edi + 4]
mov ecx, esi
sub eax, dword [edi]
cmp dword [esi + 0x14], 0x10
jb 0x426002
mov ecx, dword [esi]
push dword [edi]
mov edi, dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
push eax
push dword [ebp - 0x3c]
push ecx
call edi
test eax, eax
jne 0x426090
push 0x46d
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_jdk8u361_3183_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x5c]
call fcn.00404614
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x478dcc
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.00407bc8
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 6
call fcn.004088ff
mov byte [ebp - 4], 7
push str.GetFileVersionInfo_
mov ecx, eax
call fcn.0040be30
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.0040be44
mov ecx, eax
call fcn.0040be30
push eax
lea ecx, [ebp - 0x50]
call fcn.0042b099
mov byte [ebp - 4], 9
jmp 0x426110
mov eax, esi
call fcn.0043a73a
ret 4
push 0x464
push str.VersionResource::VersionResource
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_jdk8u361_3183_install_src_windows_common_FileUtils.cpp
lea ecx, [ebp - 0x50]
call fcn.00404614
push eax
push str.System_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x478dcc
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
call fcn.00407bc8
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 2
call fcn.004088ff
mov byte [ebp - 4], 3
push str.GetFileVersionInfoSize_
mov ecx, eax
call fcn.0040be30
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0040be44
mov ecx, eax
call fcn.0040be30
push eax
lea ecx, [ebp - 0x5c]
call fcn.0042b099
mov byte [ebp - 4], 5
mov edx, eax
lea ecx, [ebp - 0x38]
call fcn.0041ec53
lea eax, [ebp - 0x38]
mov dword [esp], 0x4891ac
push eax
call fcn.0043db4d
int3
Function at 0x44a390
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [0x48ec4c], 0
je 0x44c744
sub esp, 8
stmxcsr dword [esp + 4]
mov eax, dword [esp + 4]
and eax, 0x7f80
cmp eax, 0x1f80
jne 0x44a3c4
fnstcw word [esp]
mov ax, word [esp]
and ax, 0x7f
cmp ax, 0x7f
lea esp, [esp + 8]
jne 0x44c744
jmp fcn.00454939
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x44c755
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x44c773
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x44c7d1
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x44c7b8
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x44c7c1
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x44c7cb
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x44c7ad
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x44c737
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x44c81e
dec eax
je 0x44c815
sub eax, 3
je 0x44c80c
mov dword [ebp - 4], 0x40
jmp 0x44c83b
mov dword [ebp - 4], 4
jmp 0x44c821
mov dword [ebp - 4], 0x20
jmp 0x44c821
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x44c86d
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x44c7ed
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0044c07e
into
inc ecx
sbb byte [ebx - 1], cl
jne 0x44c878
push 1
push esi
call edi
mov eax, esi
jmp 0x44c879
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44c0c2
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x44c0f9
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x44c0e0
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x44c0f1
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x44c0fb
inc edi
add eax, 0x28
cmp edi, esi
jb 0x44c0d6
xor eax, eax
pop edi
pop esi
ret

Function at 0x44c97d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
test dword [esp + edi*8 - 1], eax
dec dword [ecx]

Function at 0x45230d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00452183
Function at 0x4229d2
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
call dword [0x44b0ec]
mov esi, eax
test esi, esi
jne 0x422a26
call dword [0x44b0e8]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
push edi
push 0x140
push 0x44edd4
call fcn.0041b09f
push 0x44f1cc
push edi
call 0x4579fb
pop ecx
pop ecx
jmp 0x422b73
mov eax, 0x5a4d
cmp ax, word [esi]
je 0x422a4f
mov esi, 0x8007000d
push esi
push 0x14a
push 0x44edd4
mov edi, esi
call fcn.0041b09f
push 0x44ee50
push esi
jmp 0x422a1a
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
je 0x422a79
mov esi, 0x8007000d
push esi
push 0x155
push 0x44edd4
mov edi, esi
call fcn.0041b09f
push 0x44eec0
jmp 0x422a4c
movzx eax, word [ecx + esi + 0x14]
push ebx
add eax, ecx
lea ebx, [esi + 0x18]
push 8
add ebx, eax
push 0x44efe4
push ebx
call 0x4471e5
add esp, 0xc
test eax, eax
je 0x422abe
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 6]
xor eax, eax
inc eax
cmp eax, ecx
jae 0x422ae5
add ebx, 0x28
inc eax
cmp dword [ebx], 0x7869772e
jne 0x422aa5
cmp dword [ebx + 4], 0x6e727562
jne 0x422aa5
cmp dword [ebx + 0x10], 0x34
jae 0x422b03
mov esi, 0x8007000d
push esi
push 0x17a
push 0x44edd4
mov edi, esi
call fcn.0041b09f
push dword [ebx + 0x10]
push 0x44f010
jmp 0x422b2d
mov esi, 0x8007000d
push esi
push 0x16e
push 0x44edd4
mov edi, esi
call fcn.0041b09f
push 0x44eff0
jmp 0x422b6a
mov ebx, dword [ebx + 0xc]
add ebx, esi
cmp dword [ebx + 4], 2
je 0x422b38
mov esi, 0x8007000d
push esi
push 0x184
push 0x44edd4
mov edi, esi
call fcn.0041b09f
push dword [ebx + 4]
push 0x44f0b4
push esi
call 0x4579fb
add esp, 0xc
jmp 0x422b72
mov edx, dword [ebp + 8]
mov ecx, edi
mov eax, dword [edx + ecx*4]
cmp eax, dword [ebx + ecx*4 + 8]
jne 0x422b4e
inc ecx
cmp ecx, 4
jne 0x422b3d
jmp 0x422b72
mov esi, 0x8007000d
push esi
push 0x18a
push 0x44edd4
mov edi, esi
call fcn.0041b09f
push 0x44f1f4
push esi
call 0x4579fb
pop ecx
pop ecx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x4e5e50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x60348b
xor al, 0x60
add byte [ecx], ah
add byte [eax], al
add byte [eax + 0x51], dl

Function at 0x4e6830
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x601318
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x631220]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x4ca37c
xor eax, eax
mov dword [edi + 4], 0
mov word [edi + 8], ax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x2c], 0xf
mov dword [edi + 0x28], eax
mov byte [edi + 0x18], al
mov dword [edi + 0x14], 0x4ca328
mov dword [edi + 0x48], 0xf
mov dword [edi + 0x44], eax
mov byte [edi + 0x34], al
mov dword [edi + 0x30], 0x4ca328
mov dword [edi + 0x64], 0xf
mov dword [edi + 0x60], eax
mov byte [edi + 0x50], al
mov dword [edi + 0x4c], 0x4ca328
mov byte [edi + 0x68], al
mov dword [edi + 0x6c], eax
mov dword [edi + 0x80], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
mov byte [edi + 0x8c], 1
mov dword [edi + 0x90], 1
mov dword [edi + 0x94], eax
mov dword [edi + 0x98], eax
mov dword [edi + 0x9c], eax
mov dword [edi + 0x7c], 0x4ca374
mov dword [esp + 0x18], eax
mov dword [edi + 0x74], eax
mov dword [edi + 0x78], eax
push 0x128
push eax
lea esi, [edi + 0x190]
mov byte [esp + 0x20], 1
push esi
mov byte [edi + 0x18c], al
call fcn.005e0f30
xor eax, eax
cmp byte [edi + 0x18c], al
setne al
push eax
push esi
call fcn.0053b060
add esp, 0x14
mov dword [edi + 0x2b8], 0
mov dword [edi + 0x2c4], 0
mov dword [edi + 0x2c8], 0
mov dword [edi + 0x2cc], 0
lea ecx, [edi + 0x2d0]
mov byte [esp + 0x18], 3
mov dword [edi + 0x2d0], 0
mov dword [edi + 0x2d4], 0
call fcn.004eb2c0
mov dword [edi + 0x2d0], eax
mov dword [edi + 0x2d8], 0
mov dword [edi + 0x2dc], 0
mov dword [edi + 0x2e0], 0
mov dword [edi + 0x2ec], 0
mov dword [edi + 0x2f0], 0
mov dword [edi + 0x2f4], 0
mov eax, dword [0x637860]
test al, 1
jne 0x4e69e7
or eax, 1
mov dword [0x637860], eax
push 0x637710
mov byte [esp + 0x1c], 7
call fcn.0053c0f0
push 0x612870
call fcn.005dfac5
add esp, 8
mov dword [edi + 0x2f8], 0x637710
mov dword [edi + 0x310], 0
mov dword [edi + 0x314], 0
mov dword [edi + 0x318], 0
mov byte [edi + 0x31c], 1
mov dword [edi + 0x320], 1
mov dword [edi + 0x324], 0
mov dword [edi + 0x328], 0
mov dword [edi + 0x32c], 0
mov dword [edi + 0x30c], 0x4ca374
mov ecx, edi
mov byte [esp + 0x18], 8
call fcn.004e99c0
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret