joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4653a8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4653b0
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4655a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4655b8
mov eax, esi
call fcn.00463138
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004045a4
lea ecx, [ebp - 0x10]
mov edx, 0x4655cc
mov eax, esi
call fcn.00463138
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004045a4
lea ecx, [ebp - 0x14]
mov edx, 0x4655e4
mov eax, esi
call fcn.00463138
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004045a4
lea ecx, [ebp - 0x18]
mov edx, 0x465600
mov eax, esi
call fcn.00463138
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004045a4
lea ecx, [ebp - 0x1c]
mov edx, 0x46561c
mov eax, esi
call fcn.00463138
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004045a4
lea ecx, [ebp - 0x24]
mov edx, 0x465634
mov eax, esi
call fcn.00463138
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408688
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408a68
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x46564c
mov eax, esi
call fcn.00463138
mov eax, dword [ebp - 0x28]
call fcn.00461f04
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x46565c
mov eax, esi
call fcn.00463138
mov eax, dword [ebp - 0x2c]
call fcn.00461f04
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x465674
mov eax, esi
call fcn.00463138
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408a68
inc eax
je 0x465545
lea ecx, [ebp - 0x34]
mov edx, 0x465674
mov eax, esi
call fcn.00463138
mov eax, dword [ebp - 0x34]
call fcn.00408a2c
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a20c
fstp qword [ebp - 0x3c]
wait
call fcn.0040a570
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x465560
lea ecx, [ebp - 0x40]
mov edx, 0x465674
mov eax, esi
call fcn.00463138
mov eax, dword [ebp - 0x40]
call fcn.00461f04
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x465684
mov eax, esi
call fcn.00463138
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004045a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4655a9
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404574
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404574
ret
Function at 0x471840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x47189a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00471830
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00460b34
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00460734
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4718a1
lea eax, [ebp - 4]
call fcn.00404550
ret
Function at 0x498bc4
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4af00c
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x498be6
shr eax, 1
xor eax, 0xedb88320
jmp 0x498be8
shr eax, 1
dec edx
jne 0x498bd4
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x498bcd
mov byte [0x4af40c], 1
pop esi
pop ebx
ret

Function at 0x498c04
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4af40c], 0
jne 0x498c1b
call fcn.00498bc4
mov eax, edi
dec eax
test eax, eax
jl 0x498c44
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4af00c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x498c25
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x49b6a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x49b6d5
dec al
je 0x49b711
dec al
je 0x49b755
dec al
je 0x49b7c0
jmp 0x49b84a
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x49b84a
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49b6e5
jmp 0x49b84a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49b84a
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49b721
jmp 0x49b84a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49b84a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x49b783
xor ebp, ebp
jmp 0x49b794
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x49b79d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x49b765
jmp 0x49b84a
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49b84a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x49b818
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00498c4c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x49b7d4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a2ec8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a00
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4a3042
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
nop
nop
nop
xor edx, edx
mov eax, 2
call fcn.004628cc
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.004628ec
nop
nop
nop
jmp 0x4a3008
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004047c0
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004090d8
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408438
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408438
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.0040495c
je 0x4a2fe8
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004047c0
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408438
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408438
mov edx, dword [ebp - 0x148]
pop eax
call fcn.0040495c
jne 0x4a2fff
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.0046290c
test eax, eax
jne 0x4a2f49
nop
nop
nop
push ebx
call sub.kernel32.dll_CloseHandle_1
nop
nop
nop
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3049
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404574
lea eax, [ebp - 4]
call fcn.00404550
ret

Function at 0x4a3360
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a3426
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
xor eax, eax
push ebp
push 0x4a33e0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 8]
mov ecx, 0x4a3440
mov edx, dword [0x4af424]
call fcn.0040485c
mov eax, dword [ebp - 8]
call fcn.00404a10
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x4a3440
mov edx, dword [0x4af440]
call fcn.0040485c
mov eax, dword [ebp - 0xc]
call fcn.00404a10
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a3408
nop
nop
nop
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a342d
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404574
ret
Function at 0x4a3ca0
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x41
push 0
push 0
dec ecx
jne 0x4a3ca8
push ebx
lea ebx, [ebp - 0x1d0]
xor eax, eax
push ebp
push 0x4a3f6c
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
lea eax, [ebp - 4]
mov ecx, 0x4a3f80
mov edx, dword [0x4af424]
call fcn.0040485c
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00402ddc
mov eax, ebx
call fcn.00402b78
call fcn.00402884
mov edx, 0x4a3f98
mov eax, ebx
call fcn.00404c2c
call fcn.00403214
call fcn.00402884
nop
nop
nop
lea edx, [ebp - 0x1dc]
xor eax, eax
call fcn.00402a44
mov eax, dword [ebp - 0x1dc]
lea edx, [ebp - 0x1d8]
call fcn.004090d8
mov ecx, dword [ebp - 0x1d8]
lea eax, [ebp - 0x1d4]
mov edx, 0x4a3fac
call fcn.0040485c
mov edx, dword [ebp - 0x1d4]
mov eax, ebx
call fcn.00404c2c
call fcn.00403214
call fcn.00402884
mov edx, 0x4a3fc8
mov eax, ebx
call fcn.00404c2c
call fcn.00403214
call fcn.00402884
mov edx, 0x4a3fe8
mov eax, ebx
call fcn.00404c2c
call fcn.00403214
call fcn.00402884
push 0x4a3ff8
lea edx, [ebp - 0x1e4]
xor eax, eax
call fcn.00402a44
push dword [ebp - 0x1e4]
push 0x4a4008
lea eax, [ebp - 0x1e0]
mov edx, 3
call fcn.004048d0
mov edx, dword [ebp - 0x1e0]
mov eax, ebx
call fcn.00404c2c
call fcn.00403214
call fcn.00402884
nop
nop
nop
push 0x4a4014
lea edx, [ebp - 0x1ec]
xor eax, eax
call fcn.00402a44
push dword [ebp - 0x1ec]
push 0x4a4008
push 0x4a4028
lea eax, [ebp - 0x1e8]
mov edx, 4
call fcn.004048d0
mov edx, dword [ebp - 0x1e8]
mov eax, ebx
call fcn.00404c2c
call fcn.00403214
call fcn.00402884
mov edx, 0x4a403c
mov eax, ebx
call fcn.00404c2c
call fcn.00403214
call fcn.00402884
push 0x4a404c
lea edx, [ebp - 0x1f8]
xor eax, eax
call fcn.00402a44
mov eax, dword [ebp - 0x1f8]
lea edx, [ebp - 0x1f4]
call fcn.004090a4
push dword [ebp - 0x1f4]
push 0x4a405c
lea eax, [ebp - 0x1f0]
mov edx, 3
call fcn.004048d0
mov edx, dword [ebp - 0x1f0]
mov eax, ebx
call fcn.00404c2c
call fcn.00403214
call fcn.00402884
push 0x4a4088
lea edx, [ebp - 0x200]
xor eax, eax
call fcn.00402a44
push dword [ebp - 0x200]
push 0x4a4008
push 0x4a40a0
lea eax, [ebp - 0x1fc]
mov edx, 4
call fcn.004048d0
mov edx, dword [ebp - 0x1fc]
mov eax, ebx
call fcn.00404c2c
call fcn.00403214
call fcn.00402884
push 0x4a40b4
lea edx, [ebp - 0x208]
xor eax, eax
call fcn.00402a44
push dword [ebp - 0x208]
push 0x4a4008
lea eax, [ebp - 0x204]
mov edx, 3
call fcn.004048d0
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00404c2c
call fcn.00403214
call fcn.00402884
nop
nop
nop
mov edx, 0x4a40c8
mov eax, ebx
call fcn.00404c2c
call fcn.00403214
call fcn.00402884
mov eax, ebx
call fcn.00402ea4
call fcn.00402884
mov eax, 0x64
call fcn.00461fac
push 0
push 0x4a40d0
call sub.kernel32.dll_WinExec
nop
nop
nop
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3f73
lea eax, [ebp - 0x208]
mov edx, 0xe
call fcn.00404574
lea eax, [ebp - 4]
call fcn.00404550
ret
Function at 0x4a40e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a00
xor eax, eax
push ebp
push 0x4a421a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x4a4230
call fcn.004045a4
nop
nop
nop
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a10
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a4201
mov eax, dword [ebp - 8]
call fcn.0040271c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a41fa
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a10
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4a41e1
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4a4238
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
cmp dword [ebp - 0x14], 0
je 0x4a41de
push ebx
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
mov eax, esi
shr eax, 0x10
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
and esi, 0xffff
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 0xc]
mov eax, edi
shr eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
and edi, 0xffff
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x34]
mov ecx, 3
mov eax, 0x4a4244
call fcn.00409900
nop
nop
nop
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4201
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0040273c
ret
nop
nop
nop
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4221
lea eax, [ebp - 4]
call fcn.00404550
ret
Function at 0x4a49e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x4a4ab4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, 0x10
call fcn.00407174
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.00407174
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], 5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push ebx
push 0x4a4acc
push esi
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.004048d0
mov eax, dword [ebp - 0x5c]
call fcn.00404a10
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4a4a9b
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4abb
lea eax, [ebp - 0x5c]
call fcn.00404550
ret
Function at 0x4a4e48
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a5035
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
xor eax, eax
push ebp
push 0x4a5010
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4adafc]
cmp byte [eax], 0
je 0x4a4fad
mov ecx, dword [0x4ada68]
mov ecx, dword [ecx]
mov edx, dword [0x4ad658]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.0040485c
mov eax, dword [ebp - 8]
call fcn.00408dd8
test al, al
je 0x4a4ece
mov ecx, dword [0x4ada68]
mov ecx, dword [ecx]
mov edx, dword [0x4ad658]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
call fcn.0040485c
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004a49e8
mov eax, dword [0x4ad494]
cmp byte [eax], 0
je 0x4a4f73
xor edx, edx
mov eax, dword [0x4af480]
call fcn.00453db0
mov edx, dword [0x4ad658]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, 0x4a5048
call fcn.0040485c
mov eax, dword [ebp - 0x10]
call fcn.00408de8
test al, al
jne 0x4a4f26
mov edx, dword [0x4ad658]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, 0x4a5048
call fcn.0040485c
mov eax, dword [ebp - 0x14]
call fcn.00408e0c
push 0
mov edx, dword [0x4ad658]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
mov ecx, 0x4a505c
call fcn.0040485c
mov eax, dword [ebp - 0x18]
call fcn.00404a10
push eax
mov edx, dword [0x4ad658]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
mov ecx, 0x4a507c
call fcn.0040485c
mov eax, dword [ebp - 0x1c]
call fcn.00404a10
push eax
call sub.kernel32.dll_CopyFileA
nop
nop
nop
call fcn.004a3ca0
jmp 0x4a4fad
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x31c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
mov ecx, dword [eax]
call dword [ecx + 0x1d8]
mov dl, 1
mov eax, dword [0x4af480]
call fcn.00453db0
mov eax, dword [0x4af480]
call fcn.0043afc8
push 0x7d0
call sub.kernel32.dll_Sleep_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5017
mov eax, dword [0x4ad448]
cmp dword [eax], 0
je 0x4a5007
mov eax, dword [0x4ad494]
cmp byte [eax], 0
jne 0x4a5007
push 1
push 0x4a508c
push 0x4a508c
mov ecx, dword [0x4ad448]
mov ecx, dword [ecx]
mov edx, dword [0x4ad658]
mov edx, dword [edx]
lea eax, [ebp - 0x20]
call fcn.0040485c
mov eax, dword [ebp - 0x20]
call fcn.00404a10
push eax
push 0x4a5090
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 4]
call fcn.0045711c
ret
Function at 0x401590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405f00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], esp
push 0x4082c0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0x63
call fcn.00404bf0
mov cl, 0x45
lea edx, [ebp - 0x50]
mov byte [ebp - 0x4f], cl
mov byte [ebp - 0x4c], cl
lea ecx, [ebp - 0x40]
mov al, 0x6c
push ecx
push edx
mov byte [ebp - 0x40], 0x56
mov byte [ebp - 0x3f], 0x69
mov byte [ebp - 0x3e], 0x72
mov byte [ebp - 0x3d], 0x74
mov byte [ebp - 0x3c], 0x75
mov byte [ebp - 0x3b], 0x61
mov byte [ebp - 0x3a], al
mov byte [ebp - 0x39], 0x41
mov byte [ebp - 0x38], al
mov byte [ebp - 0x37], al
mov byte [ebp - 0x36], 0x6f
mov byte [ebp - 0x35], 0x63
mov byte [ebp - 0x34], 0
mov byte [ebp - 0x50], 0x4b
mov byte [ebp - 0x4e], 0x52
mov byte [ebp - 0x4d], 0x4e
mov byte [ebp - 0x4b], 0x4c
mov byte [ebp - 0x4a], 0x33
mov byte [ebp - 0x49], 0x32
mov byte [ebp - 0x48], 0x2e
mov byte [ebp - 0x47], 0x64
mov byte [ebp - 0x46], al
mov byte [ebp - 0x45], al
mov byte [ebp - 0x44], 0
call dword [0x40c130]
push eax
call dword [0x40c12c]
mov eax, 0x40164d
ret

Function at 0x401970
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405f10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], esp
push 0x4082c0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0x29
call fcn.00404bf0
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0
mov eax, dword [ecx]
mov dx, word [eax + 0x14]
lea eax, [edx + eax + 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
xor ecx, ecx
mov cx, word [edx + 6]
mov edx, dword [ebp - 0x20]
cmp edx, ecx
jge 0x401b1d
mov eax, dword [eax + 0x24]
push 0x4082c0
mov edx, eax
mov ecx, eax
shr edx, 0x1d
and edx, 1
mov byte [ebp - 4], 2
mov dword [ebp - 0x1c], edx
lea edx, [ebp - 0x28]
shr ecx, 0x1e
and ecx, 1
push edx
shr eax, 0x1f
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x4d
call fcn.00404bf0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x24]
test eax, 0x2000000
je 0x401a3d
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 8]
push 0x4000
push eax
push ecx
call dword [0x40b3f8]
mov eax, 0x401b08
ret
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
test eax, 0x4000000
lea edx, [esi + edx*2]
mov esi, dword [ebp - 0x2c]
lea edx, [esi + edx*2]
mov edx, dword [edx*4 + 0x40a58c]
mov dword [ebp - 0x1c], edx
je 0x401a63
or dh, 2
mov dword [ebp - 0x1c], edx
mov ecx, dword [ecx + 0x10]
test ecx, ecx
mov dword [ebp - 0x18], ecx
jne 0x401a91
test al, 0x40
je 0x401a82
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, 0x401a97
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x18], edx
ret
test al, 0x80
je 0x401a91
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x18], edx
mov eax, 0x401a97
ret
mov eax, 0x401b23
ret