joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488d60
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [edi + 0xb4]
cmp esi, 0xffffffff
je 0x488e71
mov eax, dword [edi + 0xdc]
and eax, 0x408
cmp eax, 8
je 0x488eb3
mov ecx, dword [edi + 0x64]
test ecx, ecx
je 0x488e33
mov eax, dword [edi + 0x78]
test eax, eax
je 0x488e33
xor ebp, ebp
mov ebx, dword [sym.imp.WS2_32.dll_send]
jmp 0x488dbb
add ebp, 1
cmp dword [edi + 0x78], ebp
jbe 0x488e33
mov ecx, dword [edi + 0x64]
imul eax, ebp, 0x114
add ecx, eax
mov byte [ecx + 0xc5], 1
add eax, dword [edi + 0x64]
cmp dword [eax + 0xbc], 0xffffffff
je 0x488db0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x649904
mov eax, dword [eax + 0xc0]
mov dword [esp], eax
call ebx
sub esp, 0x10
test eax, eax
jg 0x488db0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x488db0
mov eax, dword [0x6ab740]
mov dword [esp + 0xc], str.Failed_to_signal_quiesce_via_inter_thread_communication_channel
mov dword [esp + 8], 0x11da
mov dword [esp + 4], str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov dword [esp], eax
call dword [0x6ab744]
cmp dword [edi + 0xbc], 0xffffffff
mov byte [edi + 0xc5], 1
je 0x488e71
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x649904
mov eax, dword [edi + 0xc0]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
test eax, eax
jle 0x488e80
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x488e71
mov eax, dword [0x6ab740]
mov dword [esp + 0xc], str.failed_to_signal_quiesce_via_inter_thread_communication_channel
mov dword [esp + 8], 0x11ed
mov dword [esp + 4], str.T:_Bin_prep_mhd_src_libmicrohttpd_0.9.58_src_microhttpd_daemon.c
mov dword [esp], eax
call dword [0x6ab744]
mov dword [esp + 4], str.Using_MHD_quiesce_daemon_in_this_mode_requires_MHD_USE_ITC_n
mov dword [esp], edi
mov esi, 0xffffffff
call fcn.0048aef0
jmp 0x488e71
Function at 0x48bdc0
Capabilities:
Create thread

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov edx, dword [esp + 0x30]
cmp eax, 0xffffffff
mov dword [edx], eax
setne al
add esp, 0x2c
movzx eax, al
ret
Function at 0x48cb00
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x2c
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 1
mov dword [esp + 4], 0x8004667e
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
sub esp, 0xc
test eax, eax
sete al
add esp, 0x2c
movzx eax, al
ret
Function at 0x4993f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6abcc0]
test esi, esi
jle 0x499500
mov edi, dword [0x6abcc4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x499424
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x4994a5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x499410
mov dword [esp], eax
mov ebx, eax
call fcn.00499ce0
test eax, eax
mov edi, eax
je 0x499527
mov eax, dword [0x6abcc4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00499de0
add eax, dword [edi + 0xc]
mov edx, dword [0x6abcc4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x499507
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x49949e
sub eax, 4
and eax, 0xfffffffb
jne 0x4994b0
add dword [0x6abcc0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x6abcc4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x49949e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00634a20
lea esi, [esi]
xor esi, esi
jmp 0x49942e
mov eax, dword [0x6abcc4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00634a20
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00634a20
mov esi, esi
lea edi, [edi]

Function at 0x499960
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6abcd8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6abcd0]
sub esp, 4
test ebx, ebx
je 0x4999b5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4999ae
test esi, esi
je 0x4999ae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x499990
mov dword [esp], 0x6abcd8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x49f030
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 8], ebx
pop ebx
jmp fcn.0049e9d0
Function at 0x4a4a40
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
lea ebx, [ecx - 1]
mov ecx, 0x66666667
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov eax, ebx
mov dword [esp + 0x10], ebx
sar eax, 0x1f
mov esi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, ebx
sar ebx, 0x1f
imul ecx
mov ecx, edx
sar ecx, 2
sub ecx, ebx
mov ebx, 1
je 0x4a4a93
mov ebp, 0x66666667
mov eax, ecx
sar ecx, 0x1f
add ebx, 1
imul ebp
sar edx, 2
sub edx, ecx
mov ecx, edx
jne 0x4a4a80
mov edx, dword [esi + 0x28]
cmp edx, 0xffffffff
je 0x4a4b10
mov ecx, dword [esi + 8]
cmp ebx, edx
cmovl ebx, edx
lea edx, [ebx + 2]
mov eax, ecx
sub eax, edx
cmp ecx, edx
mov edx, 0xffffffff
cmovle eax, edx
mov ecx, 1
mov edx, edi
mov dword [esi + 8], eax
mov eax, dword [esp + 0x1c]
add ebx, 1
mov dword [esp], esi
call fcn.004a42e0
mov eax, dword [esi + 0x28]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
mov edx, eax
and eax, 0x20
or edx, 0x1c0
or eax, 0x45
mov dword [esi + 4], edx
mov edx, esi
call fcn.004a3eb0
add dword [esi + 8], ebx
mov eax, dword [esp + 0x10]
mov ecx, esi
mov edx, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004a4730
mov eax, dword [0x63a688]
cmp eax, 0xffffffff
je 0x4a4b45
test eax, eax
je 0x4a4b35
mov edx, 2
mov dword [esi + 0x28], edx
jmp 0x4a4a9b
mov dword [0x63a688], 0
call fcn.004a9b00
test al, 1
mov edx, 3
jne 0x4a4b1e
jmp 0x4a4b23
mov dword [esp], str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4a4b2b
movsx eax, byte [eax]
sub eax, 0x30
cmp eax, 2
ja 0x4a4b2b
mov dword [0x63a688], 1
jmp 0x4a4b1e
Function at 0x4aba20
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x63a6dc], eax
je 0x4aba37
add esp, 0xc
ret
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4abf30
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x4abf60
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call fcn.004ab8e0
cmp eax, 1
je 0x4abf62
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
repz ret
lea ebx, [esp + 0x15]
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
xor eax, eax
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov ecx, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x4abfb5
jmp 0x4abfd2
cmp eax, 0x6a
je 0x4abfc3
add eax, 1
cmp byte [ebx + eax], 0
jne 0x4abfb0
cmp eax, 0x6a
jne 0x4abfd2
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sub.msvcrt.dll_abort
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
jmp 0x4abfc3
Function at 0x4ac060
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x6ac748], 1
je 0x4ac075
call fcn.004abfe0
mov eax, dword [0x63a6dc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x4ac0a0
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004abe80
mov esi, eax
mov eax, dword [entry3]
test eax, eax
je 0x4ac08c
test esi, esi
je 0x4ac08c
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x38]
sub esp, 0x10
mov dword [esi + 0x1c], 0xffffffff
call fcn.004abf30
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x64], 0
mov dword [esi + 0x14], 0
call ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call ebx
lea edx, [esi + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x4ac1a2
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x6c], eax
movzx eax, byte [esi + 0x20]
sub esp, 4
mov dword [esi + 0x68], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [esi + 0x20], al
mov eax, dword [0x63a6dc]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x4ac1a2
add esp, 0x2c
mov ebx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll_abort
mov esi, esi
lea edi, [edi]
Function at 0x4ac2e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4ac310
mov edi, dword [esp + 0x28]
test edi, edi
je 0x4ac3b1
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret 0xc
cmp eax, 1
je 0x4ac3e0
cmp eax, 3
jne 0x4ac2fa
mov eax, dword [0x63a6dc]
cmp eax, 0xffffffff
je 0x4ac2fa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x4ac2fa
test byte [eax + 0x20], 0x30
je 0x4ac402
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x4ac504
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4ac384
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x4ac376
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.004ab720
lea eax, [ebx + 0x38]
call fcn.004abf30
mov esi, dword [ebx + 0xb0]
test esi, esi
jne 0x4ac489
mov eax, ebx
call fcn.004abc20
jmp 0x4ac489
mov eax, dword [0x6ac724]
test eax, eax
je 0x4ac2fa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x6ac724], 0
sub esp, 4
jmp 0x4ac2fa
mov dword [esp + 4], 0x4ab940
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x6ac724], eax
jmp 0x4ac2fa
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x4ac4b0
test eax, eax
je 0x4ac420
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
jne 0x4ac4e0
test byte [ebx + 0x24], 4
lea edi, [ebx + 0x1c]
lea esi, [ebx + 0x38]
je 0x4ac4f0
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x4ac465
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [esp], edi
call fcn.004ab720
mov eax, esi
call fcn.004abf30
mov ecx, dword [ebx + 0xb0]
test ecx, ecx
je 0x4ac3a5
mov eax, dword [0x63a6dc]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
jmp 0x4ac2fa
test eax, eax
je 0x4ac4c0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebx + 0x1c]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call fcn.004ab720
lea eax, [ebx + 0x38]
call fcn.004abf30
jmp 0x4ac2fa
call fcn.004ac1f0
jmp 0x4ac43c
mov dword [esp], edi
call fcn.004ab720
mov eax, esi
call fcn.004abf30
jmp 0x4ac2fa
call fcn.004ac1f0
jmp 0x4ac352
Function at 0x4ace70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.004ac060
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x4acef2
test byte [ebx + 0x20], 0x30
jne 0x4acea6
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_longjmp
mov eax, dword [0x63a6dc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
push edx
mov ebx, eax
je 0x4acee9
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x4acf36
test eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x68], 1
je 0x4acedc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x4acef9
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call fcn.004ac1f0
jmp 0x4ace8d
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x14], 0
je 0x4acf5d
mov eax, dword [0x63a6dc]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push eax
jmp 0x4acee9
test eax, eax
mov dword [ebx], 0xdeadbeef
je 0x4acf4a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
jne 0x4acf1c
mov eax, ebx
call fcn.004abc20
jmp 0x4acf1c
Function at 0x634a20
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4e9e20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.upx1
lea edi, [esi - 0x87000]
push edi
jmp 0x4e9e3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e9e41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e9e30
mov eax, 1
add ebx, ebx
jne 0x4e9e53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e9e64
jne 0x4e9e83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e9e83
dec eax
add ebx, ebx
jne 0x4e9e70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e9e48
add ebx, ebx
jne 0x4e9e7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e9ed5
xor ecx, ecx
sub eax, 3
jb 0x4e9e9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e9f0a
sar eax, 1
mov ebp, eax
jmp 0x4e9ea6
add ebx, ebx
jne 0x4e9ea6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e9e74
inc ecx
add ebx, ebx
jne 0x4e9eb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e9e74
add ebx, ebx
jne 0x4e9ec1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e9eb6
jne 0x4e9ed2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e9eb6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e9ef4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e9ee6
jmp 0x4e9e36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e9ef4
add edi, ecx
jmp 0x4e9e36
pop esi
mov edi, esi
mov ecx, 0x3019
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e9f12
cmp byte [edi], 0x1e
jne 0x4e9f12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e9f17
lea edi, [esi + 0xe6000]
mov eax, dword [edi]
or eax, eax
je 0x4e9f8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xea4a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xea5ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e9f44
mov ecx, edi
jns 0x4e9f73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xea5b0]
or eax, eax
je 0x4e9f89
mov dword [ebx], eax
add ebx, 4
jmp 0x4e9f61
call dword [esi + 0xea5c0]
mov ebp, dword [esi + 0xea5b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e9fc3
sub esp, 0xffffff80
jmp 0x467227
Function at 0x408320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
call fcn.004017a0
mov eax, dword [0x40c044]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x25], 0x47587766
mov dword [ebp - 0x21], 0x67705963
mov dword [ebp - 0x1d], 0x43696743
mov dword [ebp - 0x19], 0x53544449
mov dword [ebp - 0x15], 0x52736643
mov dword [ebp - 0x11], 0x6c6c642e
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x25]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x4083ab
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_load_DLL._Error_code:__d_n
call fcn.00408434
mov eax, 1
jmp 0x40841a
mov dword [esp + 4], str.vKrZrwXRiSRuirSctxVa
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x408400
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_get_function_address._Error_code:__d_n
call fcn.00408434
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call eax
sub esp, 4
mov eax, 1
jmp 0x40841a
mov eax, dword [ebp - 0x34]
call eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call eax
sub esp, 4
mov eax, 0
mov edx, dword [ebp - 0xc]
sub edx, dword [0x40c044]
je 0x40842a
call fcn.004016b0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x10001730
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, 0x10
mov esi, 0x3650650
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
add esi, 0xfffffffe
xor ecx, ecx
test esi, esi
jle 0x100017c2
jmp 0x10001760
movzx edi, byte [edx + ecx]
shr edi, 2
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax], bl
movsx edi, byte [edx + ecx]
movzx ebx, byte [edx + ecx + 1]
and edi, 3
shr ebx, 4
shl edi, 4
or edi, ebx
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax + 1], bl
movsx ebx, byte [edx + ecx + 1]
movzx edi, byte [edx + ecx + 2]
and ebx, 0xf
add ebx, ebx
shr edi, 6
add ebx, ebx
or edi, ebx
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax + 2], bl
movsx edi, byte [edx + ecx + 2]
and edi, 0x3f
movzx ebx, byte [ebp + edi - 0x44]
mov byte [eax + 3], bl
add ecx, 3
add eax, 4
cmp ecx, esi
jl 0x10001760
cmp ecx, dword [ebp + 8]
jge 0x1000183e
movzx esi, byte [ecx + edx]
shr esi, 2
mov bl, byte [ebp + esi - 0x44]
mov esi, dword [ebp + 8]
dec esi
mov byte [eax], bl
cmp ecx, esi
jne 0x10001801
movsx ecx, byte [ecx + edx]
and ecx, 3
add ecx, ecx
mov dl, byte [ebp + ecx*8 - 0x44]
mov byte [eax + 1], dl
pop edi
mov byte [eax + 2], 0x3d
add eax, 3
pop esi
mov word [eax], 0x3d
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [ecx + edx + 1]
movsx ecx, byte [ecx + edx]
movzx edx, byte [esi]
and ecx, 3
shl ecx, 4
shr edx, 4
or ecx, edx
movzx ecx, byte [ebp + ecx - 0x44]
mov byte [eax + 1], cl
movsx edx, byte [esi]
and edx, 0xf
movzx ecx, byte [ebp + edx*4 - 0x44]
pop edi
mov byte [eax + 2], cl
add eax, 3
pop esi
mov word [eax], 0x3d
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000a310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x365a3f4
mov dword [ebp - 4], 0x10
call dword [0x365009c]
push 0x365a3f4
call dword [0x36500a0]
or ecx, 0xffffffff
mov edx, 0x365a3f4
test eax, eax
je 0x1000a35d
movzx esi, byte [edx]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x3659568]
inc edx
dec eax
jne 0x1000a344
mov edi, dword [0x36504b0]
not ecx
mov esi, ecx
push esi
push 0x3659290
push 0x365a40c
call edi
lea ebx, [esi + esi]
push ebx
push 0x3659290
push 0x365a3b8
call edi
lea ecx, [esi + esi*2]
push ecx
push 0x3659290
push 0x365a448
call edi
push esi
push 0x36592a8
push 0x365a4dc
call edi
push ebx
push 0x36592a8
push 0x365a49c
call edi
add esp, 0x3c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a5a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x101
lea eax, [ebp - 0x104]
push eax
push ecx
call dword [0x36504c8]
mov edx, eax
or eax, 0xffffffff
lea ecx, [ebp - 0x104]
test edx, edx
je 0x1000a5ea
push esi
lea esp, [esp]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x3659568]
inc ecx
dec edx
jne 0x1000a5d0
pop esi
not eax
mov esp, ebp
pop ebp
ret