joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001415
Capabilities:
Read file via mapping

Disassembly:
push 0x1c
push 0x10009c70
call fcn.100074a4
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], edi
push edi
push edi
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x10001508
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x10001508
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x10001508
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], ax
je 0x10001493
push 0xb
jmp 0x10001502
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x454c
jne 0x1000148f
cmp dword [eax + 0xbc], edi
jne 0x100014b4
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
push 0x714
jmp 0x10001502
mov eax, dword [eax + 0xb8]
add eax, ecx
mov esi, dword [eax + 8]
add eax, 0xc
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edi
je 0x100014fe
mov eax, dword [ebx]
cmp eax, esi
jb 0x100014fe
push eax
push edi
push dword [ebp + 0x10]
call sub.MSVCR90.dll_memset
push esi
push dword [ebp - 0x2c]
push dword [ebp + 0x10]
call sub.MSVCR90.dll_memcpy
add esp, 0x18
mov dword [ebx], esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x28], 1
jmp 0x10001508
mov dword [ebx], esi
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
call fcn.1000151f
mov eax, dword [ebp - 0x28]
call fcn.100074e9
ret

Function at 0x10003250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10003267
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
invalid
inc ebp

Function at 0x100032b2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.10002f79
inc edx
fdiv dword [0xc0458d0c]
push eax
call fcn.10002f89
push eax
push esi
push dword [ebp + 8]
call fcn.10002f3e
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.10002f79
mov eax, dword [0x8d2d764f]
inc ebp
call 0x60e8906f
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10002f89
push eax
push esi
push dword [ebp + 8]
Function at 0x1000332b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.10002f3e
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10002f89
push eax
push esi

Function at 0x10003605
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1000362d
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10003628
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10003612
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1000361a
cmp edx, ebx
jne 0x10003768
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x100035e9
invalid
add eax, dword [eax + 4]
jmp 0x100035d6
mov dword [ebp + 0xc], ebx
jmp 0x10003638
invalid
invalid

Function at 0x10003627
Capabilities:
Inspect section memory permissions

Disassembly:
rol dword [ebx], 0x40
add al, 0xeb
test eax, 0xeb0c5d89
push es

Function at 0x1000367b
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10003650
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000366e
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
ror byte [ecx - 0x3e7443bb], cl
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100036cc
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x100036b3
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100036bc
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je sym.RTFC.dll_public:_struct_LEXEME_DESC____thiscall_CLexicalAnalyzer::GetHeadLexeme_void_
add ecx, eax
or byte [ecx], 4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10003632

Function at 0x100037cb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
invalid
invalid
invalid
cld
Function at 0x10003ef6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
cld
invalid
invalid
invalid

Function at 0x100041ef
Capabilities:
Encode data using xor

Disassembly:
mov byte [ebp - 0x3ee], 0xb0
mov byte [ebp - 0x3ed], 0xf1
call fcn.10002f79
and dh, dh
push es
xor cl, byte [ebp - 0x3fb7b]
call dword [eax - 0x18]
invalid

Function at 0x100043b6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
invalid
invalid
cmp dword [ebp - 0x700], 5
jge 0x100043cf
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
cld
invalid
dec dword [edi]
mov esi, 0xc133dc4d
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x10004379
call fcn.10002f79
invalid

Function at 0x100043cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
invalid
invalid
cmp dword [ebp - 0x700], 5
jge 0x100043cf
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
cld
invalid
dec dword [edi]
mov esi, 0xc133dc4d
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x10004379
call fcn.10002f79
invalid

Function at 0x100043e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
dec edi

Function at 0x10004410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
dec edi

Function at 0x10004f85
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x10004fc3
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
cld
invalid
invalid
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x10004fc8
jmp 0x1000491b
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1000500f
lea eax, [ebp - 0x714]
push eax
call fcn.10002f89
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.10002f3e
add esp, 0xc
les ecx, [ecx + ecx*4]
invalid
test ah, bh
invalid
invalid
cmp dword [ebp - 0x37c], 0
je 0x1000501a
jmp fcn.1000501f
jmp 0x1000491b
Function at 0x10007378
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000f234]
jne 0x10007382
repz ret
jmp fcn.10007a0c

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x30130685
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x29d314b7
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4012e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401309
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop esi
ret

Function at 0x401330
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401359
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret
Function at 0x4013e0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x100
push ebx
push esi
push edi
xor ebx, ebx
mov al, bl
push 0x20
add al, 0x63
push str.EVAMJN1.1_SETUP_CHECK_FILE...
push str.c:evamjn.tmp
mov byte [str.c:evamjn.tmp], al
call fcn.00401330
add esp, 0xc
test eax, eax
jne 0x401412
inc ebx
cmp ebx, 0x18
jl 0x4013eb
cmp ebx, 0x18
jne 0x40143c
mov ecx, dword [0x40a6b8]
push 0
push str._SYSTEM_ERROR_
push str.TempFile
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x100
ret
push 0x40a6bc
push 0x405030
call section..text
mov al, byte [str.c:evamjn.tmp]
push 0x8000
push 0x40a6bc
push str.c:evajnchk.exe
mov byte [str.c:evajnchk.exe], al
mov byte [str.c:evajnchk.pif], al
call fcn.00401330
add esp, 0x14
lea edx, [esp + 0xc]
push edx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov al, byte [esp + 0xc]
push 0
mov byte [0x409008], al
mov al, bl
add al, 0x63
push str.c:evajnchk.exe_z_90797_1_c:evamjn.tmp
mov byte [str.c:evajnchk.exe_z_90797_1_c:evamjn.tmp], al
mov byte [0x409012], al
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jae 0x4014cf
mov ecx, dword [0x40a6b8]
push 0
push str._SYSTEM_ERROR_
push 0x409044
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x100
ret
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
push 0x3e8
call esi
push 8
push 0x40a6bc
push str.c:evamjn.tmp
call fcn.004012e0
add esp, 0xc
test eax, eax
je 0x401513
xor eax, eax
mov dl, byte [eax + 0x40a6bc]
mov cl, byte [eax + str.EVAMJN1.1_SETUP_CHECK_FILE...]
cmp dl, cl
jne 0x40150e
inc eax
cmp eax, 8
jl 0x4014f8
cmp eax, 8
jne 0x401556
cmp edi, 0xf
je 0x40151b
inc edi
jmp 0x4014d7
mov eax, dword [0x40a6b8]
push 0
push str._SYSTEM_ERROR_
push 0x409044
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.c:evajnchk.exe
call fcn.004016da
push str.c:evajnchk.pif
call fcn.004016da
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x100
ret
push str.c:evajnchk.exe
call fcn.004016da
push str.c:evajnchk.pif
call fcn.004016da
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x100
ret
Function at 0x401580
Capabilities:
Check for time delay via gettickcount
Create process on windows

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
sub esp, 0x1c
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.004012c0
add esp, 0x10
test eax, eax
jne 0x4015c3
mov ecx, dword [0x40a6b8]
push eax
push str._SYSTEM_ERROR_
push 0x4090cc
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add esp, 0x1c
ret 0x10
call fcn.004013e0
test eax, eax
jne 0x4015e1
push str.c:evamjn.tmp
call fcn.004016da
add esp, 4
xor eax, eax
add esp, 0x1c
ret 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WinExec]
push ebp
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 1
push 0
push 0
lea edx, [esp + 0x1c]
push 0
push edx
call ebp
test eax, eax
je 0x40162f
cmp dword [esp + 0x14], 0x12
je 0x40168d
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4015fd
call esi
sub eax, dword [0x40a6b4]
cmp eax, 0x10
jb 0x4015fd
call fcn.00401380
test eax, eax
je 0x401668
push 0
push str.data2.cab
call ebx
cmp eax, 0x1f
jae 0x401668
mov edx, dword [0x40a6b8]
push 0
push str._SYSTEM_ERROR_
push 0x40908c
push edx
call edi
push str.c:evamjn.tmp
call fcn.004016da
mov eax, dword [0x40a6b8]
add esp, 4
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
call esi
mov dword [0x40a6b4], eax
jmp 0x4015fd
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x402391
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x409308
cmp edx, dword [eax]
je 0x4023b3
add eax, 8
inc ecx
cmp eax, 0x409398
jl 0x4023a4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x409308]
jne 0x4024e1
mov eax, dword [0x41a6c4]
cmp eax, 1
je 0x4024bb
test eax, eax
jne 0x4023e4
cmp dword [0x4090f0], 1
je 0x4024bb
cmp edx, 0xfc
je 0x4024e1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40241b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00402940
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402ab0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40245e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402ab0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4043d8
push edi
call fcn.00403740
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00402940
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402950
lea eax, [ebp - 0xa0]
push 0x4043b8
push eax
call fcn.00402950
push dword [esi + 0x40930c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402950
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004036ae
add esp, 0x2c
pop edi
jmp 0x4024e1
lea eax, [ebp + 8]
lea esi, [esi + 0x40930c]
push 0
push eax
push dword [esi]
call fcn.00402ab0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x46e880
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x62000]
push edi
or ebp, 0xffffffff
jmp 0x46e8a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x46e8a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46e898
mov eax, 1
add ebx, ebx
jne 0x46e8bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x46e8b0
jne 0x46e8cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46e8b0
xor ecx, ecx
sub eax, 3
jb 0x46e8e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x46e952
mov ebp, eax
add ebx, ebx
jne 0x46e8eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x46e8f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x46e91c
inc ecx
add ebx, ebx
jne 0x46e908
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46e8fd
jne 0x46e919
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46e8fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46e93c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46e92d
jmp 0x46e89e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46e93c
add edi, ecx
jmp 0x46e89e
pop esi
mov edi, esi
mov ecx, 0x592
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x46e95a
cmp byte [edi], 0x19
jne 0x46e95a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x46e95f
lea edi, [esi + 0x6c000]
mov eax, dword [edi]
or eax, eax
je 0x46e9ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6e3e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6e4b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46e98c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6e4bc]
or eax, eax
je 0x46e9c8
mov dword [ebx], eax
add ebx, 4
jmp 0x46e9a9
call dword [esi + 0x6e4b8]
mov ebp, dword [esi + 0x6e4c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x46ea02
sub esp, 0xffffff80
jmp 0x40ef61
Function at 0x409e8c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409f5f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409f78
push ebx
push 0x409f84
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409f0c
mov al, 0x6a
call fcn.00409ae8
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409e60
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409f15
call fcn.00409e60
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409f66
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x40a018
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40a0cc
jmp 0x40a0c1
cmp dword [esi + 0x10], 0x1000
jne 0x40a0ad
test byte [esi + 0x15], 1
jne 0x40a0ad
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40a06c
cmp eax, 2
je 0x40a06c
cmp eax, 0x10
je 0x40a06c
cmp eax, 0x20
jne 0x40a081
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40a081
mov bl, 1
xor ebp, ebp
jmp 0x40a092
mov eax, dword [esi]
add eax, ebp
call fcn.0040a010
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40a085
test bl, bl
je 0x40a0ad
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40a0cc
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40a044
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x4d4bb8b0
fnstcw word [esp + ecx*8]
dec eax
cmp byte [0x5d72ca5d], dh
out 0xbe, eax
rol dword [edi], 1
xor dword [esi - 0x339af23a], esi
test byte [ebx - 0x2c60e8e], ah
invalid