joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe73aa6
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0xc6c00a
jmp 0xe73a66
mov ax, word [esp]
xor ax, 0x6bcf
inc ax
bswap eax
xor ax, bp
jmp 0xe73768
lea esp, [esp + 3]
lea esp, [esp + 8]
xor dl, 0x5d
btc ax, di
jmp 0xe7381c
bsf eax, ebx
jg 0xe73791
jle 0xe73791
mov byte [0x2ddebb2b], al
imul ecx, eax, 0x54a5c24c
rcr dword [ecx - 0x48], cl
wait
neg dl
mov eax, dword [esp]
xchg al, ah
lea eax, [edx + 0xd8]
mov ax, 0xc701
jmp 0xe73752
mov al, bh
sub esp, 2
lea esp, [esp + 3]
jmp 0xe737c1
neg dl
lea eax, reloc.mscoree.dll__CorExeMain
sub esp, 0x15
jmp 0xe737a2
jp 0xe7377b
mov al, bh
sub esp, 2
jmp 0xe737e1
inc ax
bswap eax
xor ax, bp
jmp 0xe73768
lea esp, [esp + 0x14]
sub dl, 0x85
mov ah, 0x60
xchg al, ah
mov ah, 0xee
jmp 0xe737fd
lea esp, [esp + 3]
jmp 0xe737c1
bswap eax
lea esp, [esp + 2]
jmp 0xe73f05
lea eax, reloc.mscoree.dll__CorExeMain
sub esp, 0xa
jle 0xe737e7
bswap eax
jmp 0xe73f3c
jns 0xe736f9
mov ax, word [esp]
xor ax, 0x6bcf
jmp 0xe737b8
mov dx, 0x6626
rdtsc
jmp 0xe738bf
jo 0xe738b4
bswap edx
mov edx, dword [esp]
jmp 0xe7382c
pushal
mov dword [esp + 3], ebp
jmp 0xe73886
inc ax
jle 0xe7384b
pushal
mov dword [esp + 3], ebp
lea edx, [ecx*4]
xchg ah, al
rdtsc
jmp 0xe73891
lea edx, [ecx*4]
xchg ah, al
rdtsc
call 0xe73897
leave
jmp 0xe738dc
setge dh
mov dx, 0xf566
bsr dx, bx
ja 0xe738c6
and dx, sp
call fcn.00e73953
push 0xac5d228b
mov edi, 0x148bca0f
and al, 0x66
mov edx, 0x310f6626
bswap edx
mov edx, dword [esp]
mov dx, 0x6626
rdtsc
xor bl, 0x3d
rdtsc
jmp 0xe73861
and dx, sp
jmp 0xe73906
lea esp, [esp + 0x24]
dec bl
mov dx, bp
lea eax, [edi*4]
xchg ah, dl
jmp 0xe73899
lea edx, [ebp*4]
jmp 0xe739da
ja 0xe739a1
ror dx, cl
jmp 0xe739a4
ror dx, cl
inc esi
sub eax, edx
jmp 0xe73842
add bl, 0xd7
setnp al
mov edx, 0x562c2bca
mov dl, byte [esp]
call fcn.00e73912
mov eax, edi
mov dx, word [esp]
mov word [esp], cx
lea edx, [ebx - 0xd0]
jmp 0xe73e82
mov eax, 0xff2ab5f2
mov ax, 0xbd0e
add cl, dl
lea eax, [eax - 0x11]
dec dx
jmp 0xe7392e
bsr eax, ebp
not ah
not ax
jmp 0xe73a33
shl edx, 2
mov ax, cx
lea eax, reloc.mscoree.dll__CorExeMain
jmp 0xe70293
jmp 0xe73a25
mov eax, dword [esp]
mov ax, 0x2bd0
jmp 0xe73a97
mov ah, ch
mov eax, 0x7bc2fe16
jmp 0xe73a50
lea esp, [esp + 3]
mov edx, ebx
bsf eax, esp
jno 0xe73a4e
bsr eax, ebp
not ah
not ax
jmp 0xe73a33
mov edx, dword [edx + reloc.mscoree.dll__CorExeMain]
mov al, 0x61
call 0xe73aa6
bound ebx, qword [ebp - 0x376b17]
invalid
sub esp, 0x16
jmp 0xe73a82
not eax
mov dh, 0xea
sub esp, 0x1d
jle 0xe73abe
sub esp, 0x16
lea esp, [esp + 3]
jmp 0xe73a86
lea edx, [ecx*4]
lea esp, [esp + 3]
inc bl
jmp 0xe73d5b
lea esp, [esp + 8]
not dl
not ax
not ah
mov ax, word [esp]
jmp 0xe73a10
lea esp, [esp + 2]
jmp 0xe73f05
Function at 0xe8c79a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
push word [esp + 1]
jnp 0xe8c784
jp 0xe8c99f
lea esp, [esp + 2]
jmp 0xe8c7a7

Function at 0xe918bc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x9b8aa34e
neg cx
bswap edx
mov edx, dword [esp]
mov cx, dx
xchg dword [esp], ebx
jmp 0xe918a6

Function at 0xed68a6
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
mov byte [ecx + 2], al
jmp 0xed5cc1

Function at 0xf96732
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0xf96763
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xf9674d

Function at 0xf96748
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
call fcn.00f96030
call fcn.00f96732
mov eax, dword [eax]
jmp 0xf96771
mov eax, dword [eax + 8]
jmp 0xf967ae
push eax
jmp 0xf9602b
Function at 0x412190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x4121b5
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x4121e3
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x412258
mov ecx, 1
jmp 0x412258
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x4121f3
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x412222
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x412258
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x412234
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x412245
mov dword [ebp - 4], esi
test esi, esi
jne 0x412249
jmp 0x41224d
test esi, esi
je 0x41224d
test eax, eax
ja 0x4121fb
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x4122b8
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4213c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x4213e5
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x421413
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x421488
mov ecx, 1
jmp 0x421488
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x421423
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x421452
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x421488
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x421464
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x421475
mov dword [ebp - 4], esi
test esi, esi
jne 0x421479
jmp 0x42147d
test esi, esi
je 0x42147d
test eax, eax
ja 0x42142b
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x4214e8
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x423f90
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x108327c
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x42401c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x42401c
cmp ebx, 0x15f90
jl 0x424013
cmp ebx, 0x1d4c0
jge 0x423ff0
mov eax, 0x32
jmp 0x424015
cmp ebx, 0x2bf20
jge 0x423fff
mov eax, 0x64
jmp 0x424015
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x424015
mov eax, 0xfa
jmp 0x424015
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x424030
inc ebx
cmp ebx, 0x57e40
jl 0x423fa8
mov eax, dword [ebp - 4]
test eax, eax
je 0x42404a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.0043dd10
add esp, 4
mov eax, dword [0x1083280]
test eax, eax
jne 0x424080
cmp dword [0x4fa940], 1
je 0x424104
xor ebx, ebx
xor esi, esi
cmp dword [0x1083278], 0
je 0x4240c4
mov dword [0x1083280], 1
cmp dword [0x4fa940], 1
je 0x4240af
mov dword [0x108327c], 0
push dword [0x1083274]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x424122
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00474310
push ebx
push 0x16
call fcn.00474310
add esp, 0x10
jmp 0x424080
mov dword [0x1083278], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1083274], eax
cmp eax, 0xffffffff
jne 0x4240e8
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x42406d
push 0x423f20
call fcn.00474d30
push 0x423ee0
call fcn.00474d30
add esp, 8
jmp 0x42406d
push 1
push 2
call fcn.00474310
mov esi, eax
push 1
push 0x16
call fcn.00474310
add esp, 0x10
mov ebx, eax
jmp 0x424064
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.00410470
add esp, 0xc
test eax, eax
je 0x42414c
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x4fa89c]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x4fa898]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x4fa894]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x4fa890]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x424154
push dword [ebp - 0x10]
push dword [0x1083274]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x10]
jmp 0x42409e
Function at 0x4241a0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x108327c
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x42422c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x42422c
cmp ebx, 0x15f90
jl 0x424223
cmp ebx, 0x1d4c0
jge 0x424200
mov eax, 0x32
jmp 0x424225
cmp ebx, 0x2bf20
jge 0x42420f
mov eax, 0x64
jmp 0x424225
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x424225
mov eax, 0xfa
jmp 0x424225
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x424240
inc ebx
cmp ebx, 0x57e40
jl 0x4241b8
mov eax, dword [ebp - 4]
test eax, eax
je 0x42425a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.0043dd10
add esp, 4
mov eax, dword [0x1083280]
test eax, eax
jne 0x424290
cmp dword [0x4fa940], 1
je 0x424329
xor ebx, ebx
xor esi, esi
cmp dword [0x1083278], 0
je 0x4242e6
mov dword [0x1083280], 1
cmp dword [0x4fa940], 1
je 0x4242d1
mov dword [0x108327c], 0
push dword [0x1083274]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x424367
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp dword [0x4fa940], 1
je 0x424347
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00474310
push ebx
push 0x16
call fcn.00474310
add esp, 0x10
jmp 0x424290
mov dword [0x1083278], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1083274], eax
cmp eax, 0xffffffff
jne 0x42430d
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x42427d
push 0x423f20
call fcn.00474d30
push 0x423ee0
call fcn.00474d30
add esp, 8
jmp 0x42427d
push 1
push 2
call fcn.00474310
mov esi, eax
push 1
push 0x16
call fcn.00474310
add esp, 0x10
mov ebx, eax
jmp 0x424274
push 1
push 2
call fcn.00474310
push 1
push 0x16
mov dword [ebx + 0x64], eax
call fcn.00474310
add esp, 0x10
mov dword [ebx + 0x68], eax
jmp 0x4242c5
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.00410470
add esp, 0xc
test eax, eax
je 0x42438e
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x4fa89c]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x4fa898]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x4fa894]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x4fa890]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x424396
push dword [ebp - 0x10]
push dword [0x1083274]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp - 0x10]
jmp 0x4242b3
Function at 0x428810
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x42b7d0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x43db40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x7c]
test esi, esi
mov dword [ebp - 0xc], edi
je 0x43dcfc
mov edx, dword [0x4fa940]
mov edi, dword [esi + 0x14]
lea eax, [edi*4]
shl edi, 5
sub edi, eax
cmp edx, 2
lea ebx, [edi + 0x10877e8]
jge 0x43db8f
mov eax, dword [ebx]
test eax, eax
jne 0x43dbd0
mov dword [edi + 0x10877e8], 1
jmp 0x43dbd0
push ebx
call fcn.00424430
add esp, 4
test eax, eax
jne 0x43dbca
cmp dword [edi + 0x10877e4], 0
je 0x43dcdc
mov dword [edi + 0x10877e8], 0
push 0xffffffffffffffff
push dword [edi + 0x10877e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.00424430
add esp, 4
mov edx, dword [0x4fa940]
cmp edx, 1
je 0x43dcc8
mov eax, dword [esi + 0x18]
dec eax
mov dword [esi + 0x18], eax
test eax, eax
jle 0x43dc3f
mov eax, dword [0x4fa940]
cmp eax, 1
je 0x43dc24
cmp eax, 2
jge 0x43dbff
mov dword [edi + 0x10877e8], 0
jmp 0x43dc15
mov dword [edi + 0x10877e8], 0
push dword [edi + 0x10877e4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push dword [edi + 0x10877f8]
push dword [edi + 0x10877f4]
call fcn.00424410
add esp, 8
mov eax, dword [0x4fa940]
jmp 0x43dbee
mov edx, dword [esi]
test edx, edx
je 0x43dc4b
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x43dc56
mov dword [eax], edx
jmp 0x43dc5c
mov dword [edi + 0x10877e0], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x7c], 0
mov eax, dword [0x4fa940]
cmp eax, 1
je 0x43dcad
cmp eax, 2
jge 0x43dc81
mov dword [edi + 0x10877e8], 0
jmp 0x43dc97
mov dword [edi + 0x10877e8], 0
push dword [edi + 0x10877e4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.00410530
push esi
call fcn.00410530
add esp, 8
jmp 0x43dc15
push dword [edi + 0x10877f8]
push dword [edi + 0x10877f4]
call fcn.00424410
add esp, 8
mov eax, dword [0x4fa940]
jmp 0x43dc70
lea eax, [edi + 0x10877f4]
push eax
call fcn.004243e0
add esp, 4
jmp 0x43dbd9
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0x10877e4], eax
mov dword [edi + 0x10877e8], 0
jmp 0x43dbb3
xor eax, eax
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x43dd10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.00432af0
mov ebx, dword [ebp + 8]
cmp dword [0x108d100], 0
jne 0x43dd37
test ebx, ebx
je 0x43dd2c
mov eax, dword [ebx]
jmp 0x43dd2e
xor eax, eax
push eax
call fcn.0046dc20
add esp, 4
test ebx, ebx
je 0x43dd3f
mov eax, dword [ebx]
jmp 0x43dd41
xor eax, eax
push eax
call fcn.004c3500
add esp, 4
jmp 0x43dd24

Function at 0x449bd0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x449bdc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], edi
mov edx, eax
mov dword [ecx], 0
cmp dword [0x108d100], 0
je 0x449cb3
cmp dword [ebp + 0x20], 2
je 0x449c13
cmp dword [ebp + 0x20], 1
jne 0x449c22
mov eax, 0xffffffff
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x449c32
cmp dword [ebp + 0x20], 0xfffffffa
je 0x449d78
cmp dword [ebp + 0x20], 0
je 0x449d84
xor ecx, ecx
xor edi, edi
cmp dword [ebp + 0x18], 0
je 0x449c67
cmp dword [ebp + 0x1c], 0
je 0x449c67
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
call fcn.004c32b0
push edi
call fcn.004c3420
mov edx, dword [ebp - 0x10]
add esp, 8
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x449cb3
push edi
push esi
push ebx
call fcn.004c3350
add esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [eax], esi
je 0x449da8
push 0
push edi
push 2
push 0x4de8b0
call fcn.004c3310
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov eax, 1
mov byte [esi + ebx], 0xa
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
inc dword [edx]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x24]
test ecx, ecx
mov edx, dword [ebp - 0x10]
mov dword [edi], 0
je 0x449cdb
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x449ce0
mov edi, 0x20000
cmp esi, edi
jbe 0x449d54
cmp dword [ebp + 0x20], 0
je 0x449d54
test ecx, ecx
je 0x449cf8
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x449cfd
mov edi, 0x20000
mov dword [ebp - 0x10], edx
push 0
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x449d42
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
add ebx, edx
sub esi, edx
add dword [ecx], edx
cmp dword [ebp + 0x24], 0
je 0x449d37
mov edx, dword [ebp + 0x24]
mov edx, dword [edx + 0x13c]
test edx, edx
jne 0x449d3c
mov edx, 0x20000
cmp esi, edx
ja 0x449d42
mov edi, esi
test esi, esi
je 0x449d6b
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
jne 0x449d6b
test eax, eax
jne 0x449d00
jmp 0x449d6b
push 0
lea ecx, [ebp - 0x18]
push ecx
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edi, edx
mov ecx, 1
jmp 0x449c46
mov dword [ebp - 0x10], edx
call fcn.004c3540
mov edx, dword [ebp - 0x10]
mov edi, eax
cmp dword [0x108d100], 0
je 0x449c6b
mov ecx, 1
jmp 0x449c40
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x44da70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x44da95
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x44dac3
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x44db38
mov ecx, 1
jmp 0x44db38
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x44dad3
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44db02
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x44db38
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x44db14
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x44db25
mov dword [ebp - 4], esi
test esi, esi
jne 0x44db29
jmp 0x44db2d
test esi, esi
je 0x44db2d
test eax, eax
ja 0x44dadb
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x44db98
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x47f360
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4fb070]
jne 0x47f36a
repz ret
jmp fcn.00496fa0
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x62d55eee
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2916334c
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10298f9
Capabilities:
Encode data using base64

Disassembly:
lea eax, [eax + edx - 0x15473b56]
rol dl, 0x41
call fcn.011b3ea3

Function at 0x1101e29
Capabilities:
Encode data using xor

Disassembly:
or dword [esi], edi
das
stosb byte es:[edi], al
mov dword [0xbe7e1b76], eax
lcall 0x5616, 0x9fe884e6
lahf
push ss
push esi
ror byte [edi - 0x5c], cl
mov ecx, 0x817a0b9a
dec edi
aad 0x34
aaa
das
mov eax, 0x7bca230d
sbb al, 0x10
neg dword [ecx + eax*8 + 0x67626898]
push 0xffffffffffffff85
pcmpgtw mm4, mm0
sub dword [eax + 0x1b], esp
add dl, byte [esi + 0x33001644]
mov byte [0x34b81d20], al
lahf
xor eax, 0x343c371f
jo 0x1101de5
invalid
xor dword [edx + 0x21], esi
jb 0x1101e42
neg dl
sbb ah, ah
xor dword [ebx - 0x4b], edx
test byte [eax + 0x25], ch
push 0xa6bb6f25
adc al, 0x8c
mov sp, 0x3ce7
pop edx
sti
push 0xa6bb6f25
adc al, 0x8c
mov sp, 0x3ce7
pop edx
cmp al, 0x5a
sti
sbb dword [edi + 0x2b08e1d5], 0xac48be2b
dec esi
and ebx, dword [edi - 0xcdf6c8b]
lahf
jne 0x1101dd8
xchg ebx, eax
and bl, dh
js 0x1101e1f
adc byte [esp + edx + 0x5c], ch
inc edi
add ebp, edx
xorps xmm1, xmmword [edi - 0x78]
loope 0x1101e1d
int1
aas
xor al, 0xbf
cmpsb byte gs:[esi], byte es:[edi]
push 0xffffffffffffff82
int 0xb6
sub al, 0x99
rol bh, 0xc7
jo 0x1101e64
invalid
and byte [ebx + 0x69], 0xef
ror dl, 0xe5
sub bh, byte [ecx - 0xe26462e]
pop eax
out dx, al
das
loope 0x1101e44
wait
lodsb al, byte [esi]
out 0xe2, eax
fldenv [ebx + 0x57192a9e]
sub al, bh
or dword [ebp - 1], 0x370b2654
or byte [edi - 0x60024885], 0xd7
stosb byte es:[edi], al
push 0x67
loopne 0x1101e33
sahf
iretd