joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b586
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x40f4a4], eax
je 0x40b5ae
mov eax, 0x10dd
jmp 0x40b6a2
mov eax, dword [0x40f4a8]
test eax, eax
jne 0x40b6a2
test esi, esi
jne 0x40b5c7
push 0x57
pop eax
jmp 0x40b6a2
test ebx, ebx
jne 0x40b5cf
push 6
jmp 0x40b5c1
cmp dword [ebx], 0
jne 0x40b5e7
push 6
pop eax
mov dword [0x40f4a8], eax
mov dword [0x40f498], ebx
jmp 0x40b6a2
push edi
push 0x18
push 8
pop edi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40b688
mov ecx, dword [ebx]
call fcn.0040adb4
mov ecx, dword [ebp - 8]
mov edi, eax
call fcn.0040adb4
movzx ecx, byte [edi + 0x36]
mov edx, eax
mov eax, dword [edi + 0x40]
sub eax, ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x40b67c
cmp ecx, 0x1e
ja 0x40b67c
cmp dword [edi + 0x44], edx
jne 0x40b67c
and dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40b652
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x40b688
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 1
mov dword [esi + 8], ebx
mov dword [esi + 0x10], edi
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x40f484]
mov dword [esi], eax
xor eax, eax
mov dword [0x40f484], esi
jmp 0x40b6a1
cmp dword [0x40f488], 0
push 9
pop edi
jne 0x40b68e
mov dword [0x40f4a8], edi
test esi, esi
je 0x40b699
mov ecx, esi
call fcn.00403541
mov dword [0x40f498], ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bb80
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 2
xor edi, edi
mov dword [ebp - 0x10], 4
push edi
xor esi, esi
mov ebx, edi
push 0x402dd8
inc esi
call dword [sym.imp.iertutil.dll_Ordinal_172]
test eax, eax
je 0x40bbd2
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x18
push 0x402e40
push 0x402dd8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x40bbd2
mov ebx, dword [ebp - 0x14]
push 2
push edi
push 0x402a40
mov dword [ebp - 4], edi
call dword [sym.imp.iertutil.dll_Ordinal_172]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40bc2e
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push 0x402a40
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x40bc2e
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x40bc90
test esi, esi
je 0x40bcdc
push 2
push 1
push 0x402a40
call dword [sym.imp.iertutil.dll_Ordinal_172]
test eax, eax
je 0x40bc90
lea eax, [ebp - 0xc]
xor esi, esi
push eax
push 1
push esi
push 0x402a40
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bc96
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40bcdc
xor esi, esi
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
test ebx, ebx
je 0x40bcbf
push esi
push 0x18
push edi
push 0x4029c0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
jmp 0x40bcc8
push ecx
push ecx
mov edx, edi
call fcn.0040bd29
mov ecx, dword [ebp + 0x14]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 4]
test ecx, ecx
je 0x40bcec
mov dword [ecx], esi
jmp 0x40bcec
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40bce9
mov dword [eax], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40bd29
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ecx, edx
xor edx, edx
mov dword [ebp - 8], ecx
push edi
test esi, esi
je 0x40bd45
mov eax, dword [esi]
jmp 0x40bd47
mov eax, edx
mov edi, dword [ebp + 0x10]
mov ebx, 0x4029c0
mov dword [ebp - 4], eax
test esi, esi
je 0x40bd5c
lea eax, [ebp - 4]
push eax
jmp 0x40bd5d
push edx
push edi
push edx
push 0x18
push ecx
push ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ecx, eax
cmp ecx, 2
je 0x40bd85
cmp ecx, 3
je 0x40bd85
test esi, esi
je 0x40bd9c
mov eax, dword [ebp - 4]
mov dword [esi], eax
jmp 0x40bd9c
push esi
push edi
push 0
push 0x18
push dword [ebp - 8]
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ecx, eax
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40c987
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x40f014]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], eax
push ecx
mov esi, 0x104
mov dword [eax], edi
mov edx, esi
mov dword [eax + 4], edi
lea ecx, [esp + 0x1c]
call fcn.00403be3
push 0x403018
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.00403470
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x40ca0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40ca43
mov ecx, dword [ebp + 4]
mov edx, 0xc8
push 0x402fd0
call fcn.0040c720
mov edi, eax
jmp 0x40ca43
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.0040c86c
mov ebx, eax
test ebx, ebx
jns 0x40ca35
push ebx
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xce
call fcn.0040c701
mov edi, ebx
jmp 0x40ca43
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x40ca4d
push esi
call fcn.0040c77c
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004034e0
mov esp, ebp
pop ebp
ret 8
Function at 0x40dd30
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x40e458
call fcn.0040e288
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x40f5ac
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x40db65
cmp eax, esi
jne 0x40db58
xor esi, esi
inc esi
mov edi, esi
jmp 0x40db68
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40db3c
xor esi, esi
inc esi
cmp dword [0x40f5b0], esi
jne 0x40db7a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x40dbb4
cmp dword [0x40f5b0], ebx
jne 0x40dbae
mov dword [0x40f5b0], esi
push 0x402198
push 0x40218c
call fcn.0040dce4
pop ecx
pop ecx
test eax, eax
je 0x40dbb4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40dcde
mov dword [0x40f034], esi
cmp dword [0x40f5b0], esi
jne 0x40dbd7
push 0x402188
push 0x402160
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40f5b0], 2
test edi, edi
jne 0x40dbe4
xor eax, eax
mov ecx, 0x40f5ac
xchg dword [ecx], eax
cmp dword [0x40f5bc], 0
je 0x40dc10
push 0x40f5bc
call fcn.0040e0e0
pop ecx
test eax, eax
je 0x40dc10
push ebx
push 2
push ebx
mov esi, dword [0x40f5bc]
mov ecx, esi
call dword [0x410370]
call esi
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov ecx, dword [eax]
test ecx, ecx
je 0x40db9d
mov dword [ebp - 0x24], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x20]
movzx eax, word [ecx]
cmp ax, si
ja 0x40dc7b
test ax, ax
je 0x40dc4a
test edx, edx
jne 0x40dc7b
test ax, ax
je 0x40dc4a
cmp ax, si
ja 0x40dc4a
add ecx, 2
mov dword [ebp - 0x24], ecx
movzx eax, word [ecx]
jmp 0x40dc35
test byte [ebp - 0x40], 1
je 0x40dc56
movzx eax, word [ebp - 0x3c]
jmp 0x40dc59
push 0xa
pop eax
push eax
push ecx
push ebx
push 0x400000
call main
mov dword [0x40f030], eax
cmp dword [0x40f048], 0
jne 0x40dcc3
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp eax, 0x22
jne 0x40dc8c
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x20], edx
add ecx, 2
mov dword [ebp - 0x24], ecx
jmp 0x40dc24
cmp dword [0x40f034], 0
jne 0x40dcd7
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x40f030]
mov dword [ebp - 4], 0xfffffffe
call fcn.0040e2d0
ret
call fcn.0040e1d3
jmp 0x40db13

Function at 0x40dfd4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40e498
call fcn.0040e2fc
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40e034
cmp eax, 0xffffffff
je 0x40e034
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40e02d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40e02d
cmp edx, 0x10000000
jae 0x40e02d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40e02a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.0040e341
ret 4
Function at 0x40e090
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40e0ce
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40e0c6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40e0d0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40e0b6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40e1a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x40e1b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x40e1d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x59252fe6
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4de96796
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40c650
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40c672
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c679
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c668
mov eax, 1
add ebx, ebx
jne 0x40c68b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c680
jne 0x40c69c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c680
xor ecx, ecx
sub eax, 3
jb 0x40c6b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c722
mov ebp, eax
add ebx, ebx
jne 0x40c6bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c6c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c6ec
inc ecx
add ebx, ebx
jne 0x40c6d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c6cd
jne 0x40c6e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c6cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c70c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c6fd
jmp 0x40c66e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c70c
add edi, ecx
jmp 0x40c66e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c774
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c729
mov ecx, edi
jns 0x40c758
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc054]
or eax, eax
je 0x40c76e
mov dword [ebx], eax
add ebx, 4
jmp 0x40c746
call dword [esi + 0xc064]
mov ebp, dword [esi + 0xc058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c7a8
sub esp, 0xffffff80
jmp 0x40a6fc
Function at 0xa72dc0
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa72f10
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa72de6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa72dd2
add dl, dl
jne 0xa72df1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa72e44
xor eax, eax
add dl, dl
jne 0xa72dfe
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa72ee5
add dl, dl
jne 0xa72e0d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa72e18
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa72e23
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa72e2e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa72e3a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa72ddd
mov eax, 1
add dl, dl
jne 0xa72e52
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa72e5d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa72e49
sub eax, ebx
mov ebx, 1
jne 0xa72e90
mov ecx, 1
add dl, dl
jne 0xa72e76
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa72e81
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa72e6d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa72ddd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa72ea7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa72eb2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa72e9e
cmp eax, 0x7d00
jae 0xa72ed5
cmp eax, 0x500
jb 0xa72ed0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa72ddd
cmp eax, 0x7f
ja 0xa72ed8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa72ddd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa72f06
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa72ddd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42aa92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x42ab67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x42ab31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x42ab5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042ab71
test eax, eax
je 0x42ab67
add ebx, 0x14
jmp 0x42ab3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x42ab71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x42addd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x42addd
mov eax, 1
test eax, eax
je 0x42addd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x42addd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x42add3
mov ebx, eax
and eax, 0x80000000
jne 0x42ad4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x42addd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x42addd
mov eax, 1
test eax, eax
je 0x42addd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x42addd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x42aca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x42addd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x42ab67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x42addd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x42aca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc
Function at 0x42ae9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x42afee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x42afee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.0042aff8
test eax, eax
je 0x42afee
add ebx, 0x28
dec ecx
jne 0x42afc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x42b09e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x42b0c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x42b12e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x42b0e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x42b12e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x42b105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x42b12e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x42b123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x42b12e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x42b16b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10