joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499a1c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00491938
xor ebx, ebx
cmp dword [0x4dacac], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x499af2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x499bd2
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x4b43d8
push edi
call esi
cmp eax, ebx
je 0x499bd2
push eax
call fcn.004918ca
mov dword [esp], 0x4b43c8
push edi
mov dword [0x4dacac], eax
call esi
push eax
call fcn.004918ca
mov dword [esp], 0x4b43b4
push edi
mov dword [0x4dacb0], eax
call esi
push eax
call fcn.004918ca
mov dword [0x4dacb4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0048eb7a
test eax, eax
pop ecx
pop ecx
je 0x499ac0
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0048f732
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x499af2
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004918ca
cmp eax, ebx
pop ecx
mov dword [0x4dacbc], eax
je 0x499af2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004918ca
pop ecx
mov dword [0x4dacb8], eax
mov eax, dword [0x4dacb8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x499b77
cmp dword [0x4dacbc], ecx
je 0x499b77
push eax
call fcn.00491941
push dword [0x4dacbc]
mov esi, eax
call fcn.00491941
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x499b77
cmp edi, ebx
je 0x499b77
call esi
cmp eax, ebx
je 0x499b44
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x499b44
test byte [ebp - 0x18], 1
jne 0x499b77
lea eax, [ebp - 0x10]
push eax
call fcn.0048ebb1
test eax, eax
pop ecx
je 0x499b5f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0048f732
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x499b6e
or dword [ebp + 0x10], 0x200000
jmp 0x499bb2
or dword [ebp + 0x10], 0x40000
jmp 0x499bb2
mov eax, dword [0x4dacb0]
cmp eax, dword [ebp - 8]
je 0x499bb2
push eax
call fcn.00491941
cmp eax, ebx
pop ecx
je 0x499bb2
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x499bb2
mov eax, dword [0x4dacb4]
cmp eax, dword [ebp - 8]
je 0x499bb2
push eax
call fcn.00491941
cmp eax, ebx
pop ecx
je 0x499bb2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4dacac]
call fcn.00491941
cmp eax, ebx
pop ecx
je 0x499bd2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x499bd4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49ddf0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4d6674]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0049dd85
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004890f0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x49de3f
cmp dword [ebp - 0x1c], 5
jb 0x49de57
jmp 0x49de53
cmp dword [ebp - 0x10], 1
jne 0x49de57
cmp dword [ebp - 0x1c], 4
ja 0x49de53
jne 0x49de57
cmp dword [ebp - 0x18], 0
jbe 0x49de57
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4b4cc0
call fcn.0049dc76
test eax, eax
jge 0x49de78
mov byte [0x4dad49], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00488bf3
add ebp, 0x78
leave
ret
Function at 0x401037
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4010e3
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4010d9
push 4
push 0x1000
mov edx, dword [ebp - 0xc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4010d9
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0xc]
je 0x4010d9
push 0x8000
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40132c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x401362
xor eax, eax
jmp 0x401447
push str.UNICODE
push str.LOCALIZATION
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401386
xor eax, eax
jmp 0x401447
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4013a2
jmp 0x40142d
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4013b7
jmp 0x40142d
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x4013d0
jmp 0x40142d
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4013ee
jmp 0x40142d
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004015f0
add esp, 0xc
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [ecx]
cmp edx, 0x4d
jne 0x40141b
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 1]
cmp ecx, 0x5a
je 0x40142d
push 0x41
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call section..text
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x401444
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40149d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp + 0xc]
push edx
call fcn.00401a60
add esp, 4
mov ecx, dword [ebp + 0x10]
sub ecx, eax
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00401a60
add esp, 4
mov ecx, dword [ebp + 0xc]
add ecx, eax
push ecx
call fcn.00401930
add esp, 0xc
pop ebp
ret
Function at 0x4026b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x405130
cmp edx, dword [eax]
je 0x4026d3
add eax, 8
inc ecx
cmp eax, 0x4051c0
jl 0x4026c4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x405130]
jne 0x402801
mov eax, dword [0x4052c8]
cmp eax, 1
je 0x4027db
test eax, eax
jne 0x402704
cmp dword [0x405084], 1
je 0x4027db
cmp edx, 0xfc
je 0x402801
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40273b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00402840
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00401a60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40277e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00401a60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4043c0
push edi
call fcn.00403660
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00402840
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402850
lea eax, [ebp - 0xa0]
push 0x4043a0
push eax
call fcn.00402850
push dword [esi + 0x405134]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402850
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004035cd
add esp, 0x2c
pop edi
jmp 0x402801
lea eax, [ebp + 8]
lea esi, [esi + 0x405134]
push 0
push eax
push dword [esi]
call fcn.00401a60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4010bd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 8], 0
push esi
pop esi
call fcn.004fcc5f
push edi
push 0x441108
push 0x4410f8
mov byte [ebp - 0x14], 0x4b
mov byte [ebp - 0x13], 0x45
mov byte [ebp - 0x12], 0x52
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x10], 0x45
mov byte [ebp - 0xf], 0x4c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
call esi
push esi
call fcn.0048178c
push eax
call edi
and byte [ebp - 0x16], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
mov byte [ebp - 0x24], 0x47
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x50
mov byte [ebp - 0x20], 0x72
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x63
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x48
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x70
call esi
push eax
call edi
push dword [ebp + 8]
push 0
call eax
push eax
call dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x48ac2f
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [ebp + 1]
pop edi
movsx di, cl
mov dword [esp + 0x2c], ebp
lea edi, [esp - 0x5a285b99]
movzx bp, al
pushfd
bswap bp
mov ebp, 0x416ab1
pushfd
lea edi, [edi*8 - 0x5aefe56f]
jmp 0x4d846f
pushfd
lea ebp, [ebp - 0x28b33999]
push 0x4a53c3a9
pushal
mov edi, ebp
not bp
pushfd
mov ebp, dword [esp + 0x2c]
pushfd
push dword [esp]
push dword [esp + 0x38]
ret 0x3c
mov ebp, dword [ebp + 0x78da4]
movsx edi, al
lea esp, [esp + 0x30]
jae 0x4be565
mov di, 0x5e0e
pushal
lea ebp, [ebp - 0x28b33999]

Function at 0x49e8bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 4], ebx
mov dword [esp], ebp
lea esp, [esp + 0xc]
jl 0x4b9776
pushfd
mov edi, dword [esp + 4]
lahf
call fcn.004f9403
push 0x6c88aae
push esp
mov dword [esp], 0xa806a6c7
pushal
mov word [esp + 4], bx
push ebp
pushal
lea esp, [esp + 0x44]
jmp 0x4773cf
Function at 0x4af9d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushal
mov word [esp + 8], bx
mov dword [esp + 0x20], edi
pushfd
push 0x69554e02
mov dword [esp + 0x24], ebx
push dword [esp + 4]
call fcn.0050cde2
xor edi, dword [edi - 0x2606241d]
test al, 0x93
sbb dh, byte [ebx + 0x43]
add dword [0xa588937e], 0xc9aaaf94
mov ch, 0xcf
sal ebp, cl
out 3, eax
or ch, byte [0x351d371c]
cmp al, 0x5f
pop ebp
jge 0x493d9e
mov ebx, 0xde6a5521
lodsb al, byte [esi]
sub dword [ebp - 0x4665752a], esi
loop 0x493e7b
lock and byte [0x2a54db3f], dh
aad 0x51
push ecx
and byte [eax], dh
jo 0x493e37
aaa
or eax, 0x94648fea
xchg esp, eax
pop ss
sub eax, 0x7e5f57e6
jnp 0x493e2d
cmp al, 2
popfd
add eax, 0xde3977aa
xchg esi, eax
mov dword [0x9160d480], eax
cmp eax, 0x53fc51b7
xor bh, 0x1a
jmp 0xe995c6a7
std
cwde
dec ebp
out 0xd1, eax
stc
mov eax, dword [0x5b91dc82]
xchg ecx, eax
pop ebx
jae 0x493ef0
dec edx
xor eax, 0xe37ca40b
mov esi, 0x9c48cbfa
dec eax
pushfd
insb byte es:[edi], dx
mov ah, 0x4e
jle 0x493ede
invalid
loope 0x493e88
invalid
jbe 0x493e72
lodsd eax, dword [esi]
mov edi, 0x5cbd122e
jge 0x493f0a
cmpsd dword [esi], dword es:[edi]
cmp byte [ebx + 0x16], dh
loope 0x493ea7
das
push esp
xchg ebx, eax
pop edi
or dword [ebx + 0x4f628da4], 0x8b9fbae3
inc ebp
adc al, 0xf6
sal dh, cl
salc
xor dword [esi], ebx
add eax, 0x1bf8d00
lea edi, [edi + 1]
push 0x2cf95935
pushfd
mov dword [esp + 0x50], ecx
lea esp, [esp + 0x50]
jns 0x493dd3
push edi
pushfd
call fcn.0051bd82

Function at 0x4b5cb9
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx bx, cl
dec dword [esi + 0x28]
rdtsc
jmp 0x4e8677
movsx ax, cl
rdtsc
mov byte [ebp - 1], 1
push 0xd91763af
rdtsc
mov ebx, dword [esp + 0x28]
seto al
sets dh
xchg dl, al
mov ah, byte [esp]
mov edx, dword [esi]
movsx ecx, al
movsx ecx, bl
pop ecx
mov eax, dword [edx + 8]
movzx cx, al
movzx cx, cl
setb cl
push eax
mov ecx, esi
mov byte [esp], 0x74
jmp 0x4c2c11

Function at 0x4d0a2f
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp + 4], al
mov dword [esp + 0x38], esi
call fcn.004c2a15
push ds
paddusw mm3, qword ds:[esi]
sbb al, 0x39
cli
mov eax, 0x58c9c247
dec ebx
sub byte [esi + 0x5c4c79ab], al
pop ds
das
and dh, byte [edx]
sti
fnstenv [esp + edx*8 + 0x6698af9f]
das
std
loopne 0x4d0a62
cmp ecx, ebp
jg 0x4d0a63
jmp 0x8b9c07e7
dec esi
mov ebx, esp
adc ah, cl
sar dword [edi], 1
bound esp, qword [ebp + 0x46]
adc al, 0xae
sub al, 0xfa
xchg ebp, eax
mov dl, 0xd9
add dword [esi - 0x5d8861e0], 0xffffffcc
mov fs, word [edi - 0x1e3ef520]
push ds
mov esi, 0x4a319f6f
mov al, byte [0x91289e32]
insb byte es:[edi], dx
mov cl, 0xee
lahf
xor dword [edx - 0x60], ecx
xor bl, byte [esi - 0x4e936ed8]
out dx, al
aas
sbb byte [edx], 0x86
outsb dx, byte [esi]
add al, 0x5d
jnp 0x4d0a87
mov dword [0x979df5fd], eax
dec esi
push ecx
xor al, 0x54
out 0x3d, al
invalid
Function at 0x4d8f3c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edi
push esp
pushal
push 0xc7f4f49e
push eax
lea esp, [esp + 0x2c]
jmp 0x4b9781
push ebx
jmp 0x49bd0c
bt ebp, 3
pushfd
mov dword [ebp - 4], ebx
bt di, di
test edx, edx
pushal
jmp 0x4f4436
push edx
mov word [esp + 8], bp
add edx, eax
stc
cmc
mov dword [ebp - 8], esi
sub esp, 0xfffffff4
ja 0x4bc467
stc
stc
mov dword [ebp - 4], ebx
test dh, 0xde
bt bx, sp
clc
test edx, edx
push ecx
lea esp, [esp + 4]
jle 0x5003ee
jmp 0x49d597
push 0x5a133426
sub ebx, ebx
jmp 0x4c4cc2
mov word [esp], cx
lea esp, [esp + 0x24]
jle 0x5003ee
push 0x6760651
jmp 0x5289e9
push 0x70ec4dc1
pushal
mov dword [esp + 0x24], edi
mov byte [esp + 4], 0xf5
push dword [esp + 4]
lea esp, [esp + 0x28]
jmp 0x4b9781

Function at 0x4e19ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
jl 0x4b9776
lea esi, [ecx + 0x3c4a9a4d]
jmp 0x4b8168

Function at 0x4e669a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x4162158b
push dword [esp]
mov dword [esp + 8], 0x461d60
mov byte [esp + 4], 0xe5
mov word [esp], cx
mov dword [esp + 4], 0x4a92ef
call fcn.00508bd1

Function at 0x4e66ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp eax, ebx
call fcn.004d8f3c
movzx edx, word [esi]
movsx ax, dl
movzx eax, word [esi + 2]
cmp bh, al
sub esp, 0xffffffdc
jno 0x4e4de8
pushfd
xor ebx, ebx
add esp, 4
jo 0x480ad7
pushfd
add edx, eax
bt di, 0xb
mov dword [ebp - 8], esi
bt cx, di
clc
call fcn.00508287

Function at 0x4f4423
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x18], edx
push 0xb19b97a4
push 0xc6f12c71
call fcn.0051afdb
Function at 0x4f49fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
call fcn.00474c97
pushfd
pushfd
pushfd
mov dword [esp + 8], eax
pushal
call fcn.0046ed5f
clc
pushfd
add ebp, 2
call fcn.00467f61
pushal
stc
sub al, 0xd9
pushfd
jmp 0x474793
dec esi
call fcn.0046bb5c
jmp 0x4ce7c0
mov cl, al
not dl
mov edx, dword [ebp + 0x14]
jmp 0x526bfd
pushal
pushal
lea esp, [esp + 0x40]
jns 0x482c69
bsr ebx, esp
sar bx, cl
and eax, 0x7fffffff
shld dx, sp, cl
xchg edx, ebx
bsf dx, bx
test bl, 0x3c
add eax, dword [ecx + 0x2c]
xchg bh, dl
add cx, 0xad38
sar dh, 7
mov ebx, eax
xor cx, si
not dh
add dh, ah
lea edx, [eax + 2]
clc
bt esi, 4
btr cx, 9
jmp 0x4ffafa
setle ah
add eax, ebx
test ch, 0xd
mov ecx, dword [ebp + 8]
aaa
inc ah
mov eax, dword [esi + ebx*8 + 4]
cmp dl, dl
cmc
test eax, eax
jmp 0x493d5c
pushfd
mov dword [esp + 0x24], 0x93d1e213
pushal
mov byte [esp], bh
pushfd
lea esp, [esp + 0x48]
jmp 0x46e881
clc
neg ecx
bt esi, esp
push 0x5e5886ee
test dl, 0x32
call fcn.004a7012
mov dword [esp + 0x24], 0x5d3492cb
jmp 0x47cbcf
call fcn.005003e6
pushfd
pushfd
mov dword [ebp - 4], ebx
mov byte [esp], 0x9b
jmp 0x4fc924
cmp ebx, edx
jmp 0x4e422d
push ebp
lea esp, [esp + 0x34]
jl 0x4b9776
lea ebx, [edx + 0x4771bb94]
pushfd
jmp 0x4de589
inc ch
mov cx, word [eax]
jmp 0x50ab14
mov edi, edi
stc
jmp 0x4fc94e
rdtsc
not cl
btc eax, eax
mov eax, edi
movsx edx, bl
cmc
btr edx, 0x16
mov edx, 2
ror cl, cl
mul edx
pushfd
push esp
setnp cl
push edx
seto cl
push eax
jmp 0x4d576d
push ebx
add eax, 2
clc
test ecx, ecx
bt sp, sp
clc
test cx, cx
pushal
lea esp, [esp + 0x24]
jne 0x4ffafc
bt ebx, esi
sub eax, edx
sub di, bx
pushal
clc
add dh, dl
sar eax, 1
inc dh
shr dx, cl
lea edx, [edi + 0x36f20b9f]
lea edi, [eax + 1]
rdtsc
add ah, bl
xor ecx, ecx
jmp 0x505e18
call 0x51b9cf
cwde
mov al, al
mov eax, dword [esp + 4]
pushfd
mov byte [esp], 0xee
call fcn.004c82ef
call fcn.004e4809
push eax
nop
push edi
mov byte [esp + 4], 0xc3
push dword [esp + 4]
pushal
mov dword [esp + 0x28], eax
mov byte [esp + 4], 0xab
push dword [esp]
mov eax, dword [esp + 0x30]
call fcn.004d5044

Function at 0x508287
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 4], ebx
clc
test edx, edx
pushfd
pushfd
push esi
mov byte [esp + 4], 0x32
lea esp, [esp + 0x14]
jle 0x5003ee
jmp 0x495b4b

Function at 0x51074a
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 0x10], 0x9ce3
lea esp, [esp + 0x14]
jne 0x5195db
Function at 0x30e6590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x58]
push eax
call fcn.030e62f8
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.030e62ad
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x30e65d6
invalid
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.030e62e8
les edx, [edi + 0x2d]
jle 0x30e65b8
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x424958
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x424967
pop dword [ebp - 0x3c]
mov eax, 0xaa5c2757
sub eax, 0xaa19ddf0
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x54611
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x5807
mov ebx, eax
mov esi, 0x475e00
add esi, dword [ebp - 0x3c]
mov edx, 0x9ef0f0fd
add dword [ebp - 0x38], edi
mov edi, dword [esi]
add dword [ebp - 0x20], edx
xor edi, edx
mov dword [ebx], edi
add dword [ebp - 0x20], edx
add ebx, 0x938c30c4
sub ebx, 0x938c30c0
add esi, 0x50b12cd9
add esi, 0xaf4ed32b
loop 0x4249af
add eax, 0x3386deae
add eax, 0xcc7a7441
xor ebx, ebx
add ebx, eax
add eax, 0xfa3617a7
sub eax, 0xfa3617a2
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret