joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416e0a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 9
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
je 0x416ea3
push 0x11
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x416ea3
push 0x10
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x416ea3
push 0x12
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x416ea3
call sub.USER32.dll_GetFocus
push 5
lea edi, [ebp - 0xd]
push edi
push eax
call sub.USER32.dll_GetClassNameA
push 4
push str.Rich
lea eax, [ebp - 0xd]
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
or eax, eax
jne 0x416ea3
call sub.USER32.dll_GetFocus
push 0
push 0
push 0x44e
push eax
call sub.USER32.dll_SendMessageA
test ax, 0x800
jne 0x416ea3
xor eax, eax
jmp 0x416ece
push 0x429210
push dword [ebp + 8]
call sub.USER32.dll_GetPropA
mov dword [ebp - 4], eax
or eax, eax
je 0x416ecc
dec eax
push eax
push dword [0x46b66c]
call fcn.00418082
mov dword [ebp - 8], eax
mov eax, dword [eax + 0xc]
jmp 0x416ece
xor eax, eax
pop edi
leave
ret 4

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x65eefb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x3d084c
jmp 0x65ef3d
push esi
jmp 0x65f10b
mov byte [esp + 2], ah
push dword [esp + 4]
mov dword [esp + 0x20], edi
jmp 0x65ef33
jmp 0x65ef1b
lea esp, [esp + 0x20]
pushfd
jmp 0x65eb04
mov ax, di
jmp 0x65efeb
push word [esp + 4]
jbe 0x65ef31
mov byte [esp + 2], ah
push dword [esp + 4]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
call 0x65ef8d
add esp, dword [esi - 1]
invalid
invalid
je 0x65ef9f
add dword [eax - reloc.iphlpapi.dll_GetAdaptersInfo], ecx
and al, 2
jmp 0x65ef92
xchg dword [esp + 4], edi
pushal
push dword [esp + 0x13]
lea esp, [esp + 0x17]
lea esp, [esp + 1]
jmp 0x65efd5
mov dword [esp + 0x18], esi
call fcn.0065ef54
xchg dword [esp + 0x20], edi
push sp
push word [esp]
call fcn.0065f001
imul byte [ecx - 7]
cwde
imul edx, esi, 0x28
mov bl, byte [eax]
jg 0x65ef5a
or eax, 0x4c7dc2ab
lea edi, [edi - 0x3f]
pushal
pop dword [esp + 0xd]
pushal
lea esp, [esp + 0x2b]
lea esp, [esp + 1]
jmp 0x65efb6
mov bl, dh
bsf edx, ebp
je 0x65f01e
mov edi, ecx
jmp 0x65f020
mov edi, dword [esp + 0x2c]
lea esi, reloc.iphlpapi.dll_GetAdaptersInfo
mov ebx, dword [esp]
xchg esi, ecx
jmp 0x65f022
mov edi, ecx
jmp 0x65f008
lea esi, [esp]
rdtsc
rdtsc
neg bp
jle 0x65f0b3
jg 0x65f06f
cdq
sbb cl, byte [eax - 0x653e511]
jg 0x65f02c
mov bh, byte [ecx + 0x38]
ror byte [ebp - 0x24], cl
lea esp, [esp + 8]
lea esp, [esp + 2]
jmp 0x65efad
pushfd
push dword [esp + 3]
mov eax, edi
lea ecx, [ecx + edx]
inc ecx
je 0x65f13d
mov edx, ebx
jmp 0x65f1cf
sub esp, 0xc0
mov ebp, esp
mov ch, byte [esp]
stc
jmp 0x65f097
js 0x65f050
pushfd
push dword [esp + 3]
call 0x65f07d
and byte [esi + 0x6dae5334], ah
push edx
fisttp dword [ebx + 0x2e]
invalid
jmp 0x65f06f
push word [esp + 1]
jp 0x65f043
lea esp, [esp + 8]
lea esp, [esp + 2]
mov dword [esp + 0x18], esi
jmp 0x65efb1
call 0x65f169
pushfd
pop ds
invalid
mov ecx, dword [esp]
jmp 0x65f219
bswap edx
btc cx, sp
lea ecx, [eax + ebp]
jmp 0x65f1b9
rol edi, 0
neg edx
jmp 0x65f223
lea ebx, [ebx + ebp]
xor dh, 0x3a
jo 0x65f203
jno 0x65f203
jnp 0x65f239
not bh
mov bh, byte [esp]
jmp 0x65f23e
sahf
or eax, 0xd717e49d
or byte [esi + 0x12a66b0c], bl
outsd dx, dword [esi]
not bh
mov bh, byte [esp]
call fcn.0065f39d
arpl sp, si
push 0xd
cld
inc ebx
ja 0x65f22c
jno 0x65f25d
jecxz 0x65f274
mov al, byte [0xec831ae3]
add al, 0x83
mov byte [esi], 0xf
mov esp, 0xfb53e9c5
push ebx
sti
invalid
add edi, 0x1fb780d1
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
pushal
call fcn.0065f28b
jne 0x65f2d9
xchg edi, eax
xchg edi, eax
dec byte [ebp + 0x951c]
add byte [eax], al
neg edi
xchg dl, dh
bswap ebx
mov ebx, 0x6d51c8ca
jmp 0x65f261
btr ecx, esi
mov ebx, ecx
xchg dword [esp + 8], edi
mov bh, byte [esp]
mov dh, 0x45
jmp 0x65f326
bswap ecx
jmp 0x65f2b7
bsr bx, si
push dword [esp + 8]
ret 0xc

Function at 0x663f94
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x663fd1
mov cx, sp
xchg dword [esp], ecx
neg eax
jno 0x663f7e
mov eax, 0xe679818e
dec cx
bswap edx
jmp 0x663fbb
mov eax, 0xe679818e
dec cx
Function at 0x87e8c6
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x87e900
push eax
pushfd
mov dword [esp], ecx
call fcn.0087e8e9
mov dword [esp], edx
call fcn.0087e934

Function at 0x87e912
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 2], edi
mov dword [esp], ebp
mov dword [esp + 4], ebx
push sp
lea esp, [esp + 1]
jmp 0x87e939
mov byte [esp], ch
lea esp, [esp + 1]
mov dword [esp], esp
push bp
mov byte [esp], al
lea esp, [esp + 2]
jmp 0x87e9e9
push ebp
push esi
call fcn.0087e97b
rdtsc
mov ecx, edx
jmp 0x87ea12
lea edi, [esp + 4]
lea ebx, [esp + edi]
mov si, dx
mov cx, word [esp]
jmp 0x87ea9b
mov cx, 0xc96b
bsr ecx, ebp
xchg edx, ecx
jmp 0x87ea74
mov ah, byte [esp]
mov ah, byte [esp]
jmp 0x87ea2a
inc ecx
jp 0x87ea40
mov ah, byte [esp]
mov ah, byte [esp]
mov cx, 0xc96b
bsr ecx, ebp
xchg edx, ecx
jmp 0x87ea74
rdtsc
mov dx, di
call 0x87ea7f
pop eax
ror ebp, 0
sub esp, 0
je 0x87eac0
bswap eax
ror ch, cl
mov ch, byte [esp]
mov eax, 0x8672edad
jmp 0x87eac2
sub esp, 0xbc
mov esi, esp
mov ebx, ebp
mov dx, sp
jmp 0x87ea5c
bswap eax
ror ch, cl
mov ch, byte [esp]
jmp 0x87eae6
jmp 0x87eaaa
lea eax, [ebx*4]
jmp 0x87eaf2
rdtsc
cmc
neg ecx
push ecx
jmp 0x87eb3a
mov eax, 0x8672edad
lea eax, [ebx*4]
xchg cx, dx
lea esp, [esp + 4]
add ebp, 0x48b0fe97
neg cl
jmp 0x87eb1d
neg ecx
push ecx
jmp 0x87eb3a
js 0x87eacb
rdtsc
cmc
jmp 0x87eb03
jmp 0x87eb52
rol ebp, 0
mov eax, dword [esp]
mov cx, 0x7ddb
inc dh
js 0x87eb24
mov ax, word [esp]
jmp 0x87eb9c
mov ax, word [esp]
xchg dh, ah
mov edx, esp
mov dx, word [esp]
bswap eax
jmp 0x87ebc6
bswap eax
jmp 0x87ebc6
xchg dh, ah
mov edx, esp
mov dx, word [esp]
jmp 0x87eb86
jmp 0x87ec27
bt cx, bx
mov cx, word [esp]
neg ebp
jmp 0x87ec05
lea esp, [esp + 4]
add ebp, 0x2ef014a2
mov ecx, dword [esp]
btr edx, esp
jb 0x87eba6
bts ax, di
lea edx, [esi*4]
rdtsc
bt cx, bx
mov cx, word [esp]
jmp 0x87ebb0
mov ah, byte [esp]
stc
jmp 0x87ec4f
btc ecx, esi
je 0x87ebef
mov ah, byte [esp]
stc
jmp 0x87ec4f
lea eax, [esi*4]
jmp 0x87ec39
bts ax, di
lea edx, [esi*4]
rdtsc
jmp 0x87eba8
add ebp, dword [edi]
sbb ax, 0x7dbf
jge 0x87ec10
lea eax, [esi*4]
jmp 0x87ec39

Function at 0x87e92a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], si
lea esp, [esp + 2]
jmp 0x87e90a

Function at 0x87e97b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
jmp 0x87e9a5
push dword [esp + 3]
jl 0x87e965
pop word [esp]
push esi
push dword [esp + 1]
push dword [esp + 6]
mov dword [esp + 1], ebp
jmp 0x87e9ce
push esi
push dword [esp + 1]
push dword [esp + 6]
jmp 0x87e9ca
pushfd
jmp 0x87e780
mov dword [esp + 1], ebp
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x87e9b0
Function at 0x87e9f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 2], edi
mov dword [esp], ebp
mov dword [esp + 4], ebx
push sp
lea esp, [esp + 1]
jmp 0x87e939
mov byte [esp], ch
lea esp, [esp + 1]
mov dword [esp], esp
push bp
mov byte [esp], al
lea esp, [esp + 2]
jmp 0x87e9e9
push ebp
push esi
call fcn.0087e97b
rdtsc
mov ecx, edx
jmp 0x87ea12
lea edi, [esp + 4]
lea ebx, [esp + edi]
mov si, dx
mov cx, word [esp]
jmp 0x87ea9b
mov cx, 0xc96b
bsr ecx, ebp
xchg edx, ecx
jmp 0x87ea74
mov ah, byte [esp]
mov ah, byte [esp]
jmp 0x87ea2a
inc ecx
jp 0x87ea40
mov ah, byte [esp]
mov ah, byte [esp]
mov cx, 0xc96b
bsr ecx, ebp
xchg edx, ecx
jmp 0x87ea74
rdtsc
mov dx, di
call 0x87ea7f
pop eax
ror ebp, 0
sub esp, 0
je 0x87eac0
bswap eax
ror ch, cl
mov ch, byte [esp]
mov eax, 0x8672edad
jmp 0x87eac2
sub esp, 0xbc
mov esi, esp
mov ebx, ebp
mov dx, sp
jmp 0x87ea5c
bswap eax
ror ch, cl
mov ch, byte [esp]
jmp 0x87eae6
jmp 0x87eaaa
lea eax, [ebx*4]
jmp 0x87eaf2
rdtsc
cmc
neg ecx
push ecx
jmp 0x87eb3a
mov eax, 0x8672edad
lea eax, [ebx*4]
xchg cx, dx
lea esp, [esp + 4]
add ebp, 0x48b0fe97
neg cl
jmp 0x87eb1d
neg ecx
push ecx
jmp 0x87eb3a
js 0x87eacb
rdtsc
cmc
jmp 0x87eb03
jmp 0x87eb52
rol ebp, 0
mov eax, dword [esp]
mov cx, 0x7ddb
inc dh
js 0x87eb24
mov ax, word [esp]
jmp 0x87eb9c
mov ax, word [esp]
xchg dh, ah
mov edx, esp
mov dx, word [esp]
bswap eax
jmp 0x87ebc6
bswap eax
jmp 0x87ebc6
xchg dh, ah
mov edx, esp
mov dx, word [esp]
jmp 0x87eb86
jmp 0x87ec27
bt cx, bx
mov cx, word [esp]
neg ebp
jmp 0x87ec05
lea esp, [esp + 4]
add ebp, 0x2ef014a2
mov ecx, dword [esp]
btr edx, esp
jb 0x87eba6
bts ax, di
lea edx, [esi*4]
rdtsc
bt cx, bx
mov cx, word [esp]
jmp 0x87ebb0
mov ah, byte [esp]
stc
jmp 0x87ec4f
btc ecx, esi
je 0x87ebef
mov ah, byte [esp]
stc
jmp 0x87ec4f
lea eax, [esi*4]
jmp 0x87ec39
bts ax, di
lea edx, [esi*4]
rdtsc
jmp 0x87eba8
add ebp, dword [edi]
sbb ax, 0x7dbf
jge 0x87ec10
lea eax, [esi*4]
jmp 0x87ec39
Function at 0x87ea7f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 2], edi
mov dword [esp], ebp
mov dword [esp + 4], ebx
push sp
lea esp, [esp + 1]
jmp 0x87e939
mov byte [esp], ch
lea esp, [esp + 1]
mov dword [esp], esp
push bp
mov byte [esp], al
lea esp, [esp + 2]
jmp 0x87e9e9
push ebp
push esi
call fcn.0087e97b
rdtsc
mov ecx, edx
jmp 0x87ea12
lea edi, [esp + 4]
lea ebx, [esp + edi]
mov si, dx
mov cx, word [esp]
jmp 0x87ea9b
mov cx, 0xc96b
bsr ecx, ebp
xchg edx, ecx
jmp 0x87ea74
mov ah, byte [esp]
mov ah, byte [esp]
jmp 0x87ea2a
inc ecx
jp 0x87ea40
mov ah, byte [esp]
mov ah, byte [esp]
mov cx, 0xc96b
bsr ecx, ebp
xchg edx, ecx
jmp 0x87ea74
rdtsc
mov dx, di
call 0x87ea7f
pop eax
ror ebp, 0
sub esp, 0
je 0x87eac0
bswap eax
ror ch, cl
mov ch, byte [esp]
mov eax, 0x8672edad
jmp 0x87eac2
sub esp, 0xbc
mov esi, esp
mov ebx, ebp
mov dx, sp
jmp 0x87ea5c
bswap eax
ror ch, cl
mov ch, byte [esp]
jmp 0x87eae6
jmp 0x87eaaa
lea eax, [ebx*4]
jmp 0x87eaf2
rdtsc
cmc
neg ecx
push ecx
jmp 0x87eb3a
mov eax, 0x8672edad
lea eax, [ebx*4]
xchg cx, dx
lea esp, [esp + 4]
add ebp, 0x48b0fe97
neg cl
jmp 0x87eb1d
neg ecx
push ecx
jmp 0x87eb3a
js 0x87eacb
rdtsc
cmc
jmp 0x87eb03
jmp 0x87eb52
rol ebp, 0
mov eax, dword [esp]
mov cx, 0x7ddb
inc dh
js 0x87eb24
mov ax, word [esp]
jmp 0x87eb9c
mov ax, word [esp]
xchg dh, ah
mov edx, esp
mov dx, word [esp]
bswap eax
jmp 0x87ebc6
bswap eax
jmp 0x87ebc6
xchg dh, ah
mov edx, esp
mov dx, word [esp]
jmp 0x87eb86
jmp 0x87ec27
bt cx, bx
mov cx, word [esp]
neg ebp
jmp 0x87ec05
lea esp, [esp + 4]
add ebp, 0x2ef014a2
mov ecx, dword [esp]
btr edx, esp
jb 0x87eba6
bts ax, di
lea edx, [esi*4]
rdtsc
bt cx, bx
mov cx, word [esp]
jmp 0x87ebb0
mov ah, byte [esp]
stc
jmp 0x87ec4f
btc ecx, esi
je 0x87ebef
mov ah, byte [esp]
stc
jmp 0x87ec4f
lea eax, [esi*4]
jmp 0x87ec39
bts ax, di
lea edx, [esi*4]
rdtsc
jmp 0x87eba8
add ebp, dword [edi]
sbb ax, 0x7dbf
jge 0x87ec10
lea eax, [esi*4]
jmp 0x87ec39
Function at 0x87f303
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0x9e668c72
jmp 0x87f4fe
add eax, 0x497e78ca
jmp 0x87f5e5
mov ah, byte [esp]
mov al, 0x49
mov edx, esi
mov ah, dh
jmp 0x87f348
lea esp, [esp + 0x24]
sub cl, 0xaa
mov ax, 0xd58
and dl, 0x14
jmp 0x87f317
jnp 0x87f2ed
mov ah, byte [esp]
mov al, 0x49
jmp 0x87f35e
add cl, 0xb8
mov dl, byte [esp]
push edx
xchg dword [esp], edx
push word [esp]
jmp 0x87f780
mov edx, esi
mov ah, dh
jmp 0x87f348
inc eax
xchg ah, dl
push dword [esp]
jmp 0x87f3bb
push dword [esp]
lea edx, [esi*4]
lea esp, [esp + 2]
jmp 0x87f3c6
lea edx, [esi*4]
lea esp, [esp + 2]
lea esp, [esp + 8]
call fcn.0087f54a
mov edx, dword [esp]
cmc
jnp 0x87f3fa
bswap eax
jmp 0x87f404
bswap eax
neg edx
jmp 0x87f43e
neg edx
push eax
jmp 0x87f43f
xchg edx, eax
setno al
cmc
jbe 0x87f428
xchg dh, ah
rcl dh, 2
rdtsc
jmp 0x87f44a
xchg dh, ah
jmp 0x87f464
push eax
lea esp, [esp + 4]
neg cl
setge al
jmp 0x87f409
bsr dx, sp
jmp 0x87f46d
rcl dh, 2
rdtsc
bsr dx, sp
rol cl, 0
push esi
mov ax, 0xc6b3
not al
jmp 0x87f493
pushal
mov bp, bx
xchg ah, al
call fcn.0087f479
lea edx, [ebx*4]
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
lea esp, [esp + 4]
popal
not edx
neg dx
jmp 0x87f4f0
shl eax, 2
mov dl, 0x8c
mov edx, dword [esp]
jmp 0x87e804
jns 0x87f518
mov edx, 0x91357a03
mov edx, 0x706884a8
jmp 0x87f522
bt dx, sp
jns 0x87f524
js 0x87f52c
retf 0xd446
mov edx, 0x91357a03
mov edx, 0x706884a8
jmp 0x87f4da
neg dh
jmp 0x87f716
neg dh
mov dl, byte [esp]
jmp 0x87f719
mov dl, 0x81
mov dx, 0xaf5b
jmp 0x87e838
jmp 0x87f55c
mov esp, esi
mov dl, byte [esp]
mov dl, byte [esp]
mov dl, ch
jmp 0x87f594
jno 0x87f5af
mov edx, edi
lea esp, [esp + 2]
jmp 0x87f5b5
push eax
ret
mov edx, edi
lea esp, [esp + 2]
jmp 0x87f574
pushfd
add esp, 2
jmp 0x87f58a
mov dl, byte [esp]
mov eax, dword [eax + reloc.iphlpapi.dll_GetAdaptersInfo]
bts dx, cx
jne 0x87f572
mov dl, 0x81
mov dx, 0xaf5b
jmp 0x87e838
jle 0x87f364
inc eax
xchg ah, dl
jmp 0x87f370

Function at 0x87f54a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, dx
call fcn.0087f3e6
btc dx, di
xor ax, si
lea eax, [esi*4]
lea edi, [edi - 0x2a]
not eax
mov dh, ah
jmp 0x87f420
rdtsc
mov ax, cx
neg ah
rcl ax, cl
xchg dword [esp], edi
jmp 0x87f4bd

Function at 0x88b5eb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x88b654
mov bx, word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 2], edx
mov dx, word [esp]
lea eax, [esp + esi]
call fcn.0088b5ed

Function at 0x88b5ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ax, 0x7773
jmp 0x88b635
mov ebx, dword [esp]
mov edx, dword [esp + 6]
mov ax, word [esp]
mov eax, 0xbd430d7e
mov eax, dword [esp + 0xc]
call fcn.0088b5f3
xchg esi, eax
add eax, eax
cmp dword [edx], 0x15

Function at 0x88b5f3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 3]
call fcn.0088b61f
xchg byte [ecx], dh
xor byte [ebx], dh
mov bl, 0x81
dec esi
lea esp, reloc.iphlpapi.dll_GetAdaptersInfo
sub eax, 0x8d241c8b
sbb al, 0x38
push eax
push esi
mov eax, 0x16b68230
push ax
call fcn.0088b5eb
Function at 0x88b61f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x88b66d
push dword [esp]
mov byte [esp], dl
lea ebx, reloc.iphlpapi.dll_GetAdaptersInfo
mov ebx, dword [esp + 0x1c]
jmp 0x88b6ab
lea esp, [esp + 0x20]
push ebp
mov cx, bx
mov ebp, esp
jmp 0x8b15cd
sub esp, 0x18
xor dh, bl
push esp
jmp 0x8b15fd
sub esp, 0x16
xchg cx, dx
pop dword [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 0x10]
jmp 0x8b15b7
mov ecx, dword [esi]
pop esi
mov eax, dword [ecx + 0x3c]
lea esp, [esp + 4]
jmp 0x8b161b
push esi
mov esi, ebp
add esi, 8
jmp 0x8b15e1
add eax, ecx
mov dx, word [esp]
jmp 0x8b165e
and dword [ebp - 0xc], 0
jmp 0x8b1605
mov edx, 0x10b
clc
cmp word [eax + 0x18], dx
call fcn.008b1648

Function at 0x9a3e22
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
call fcn.009a3018
mov word [esp + 1], sp
pushal
mov word [esp + 7], bp
call fcn.009a3ddc
pushfd
pop word [esp]
call fcn.009a3e76
mov eax, dword fs:[0x30]
jmp 0x9a3e60
mov eax, dword [eax + 0xc]
jmp 0x9a3ed6
push eax
jmp 0x9a3013
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x9a3ebd

Function at 0x9a3e52
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
mov dword [esp + 0x20], esp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], esi
jmp 0x9a3e32

Function at 0x9a3e76
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x9a3e3c

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x416560
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00421650
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00421650
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4165c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x45806c]
test esi, esi
jle 0x4166e0
mov eax, dword [0x458070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4165f4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x416677
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4165e0
mov dword [esp], ebx
call fcn.00416fb0
mov edi, eax
test eax, eax
je 0x416707
mov eax, dword [0x458070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004170f0
mov edx, dword [0x458070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4166e7
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x416670
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x416680
add dword [0x45806c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x458070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x416670
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00416560
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x4165fe
mov eax, dword [0x458070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00416560
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00416560
lea esi, cs:[esi]
nop
Function at 0x416c20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x458088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x458080]
sub esp, 4
test ebx, ebx
je 0x416c75
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x416c6e
test eax, eax
jne 0x416c6e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x416c50
mov dword [esp], 0x458088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x416fb0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x416fd5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x416fe0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x416fd5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x417028
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x41701e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x41702a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x417010
xor eax, eax
pop ebx
pop esi
ret
Function at 0x41c0c0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2d
mov dword [esp + 4], str._buffer_overflow_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x41c0f9
mov ecx, 8
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x41c120
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x2c
mov dword [esp + 4], str._stack_smashing_detected_:_terminated_n
mov dword [esp], 2
call sub.msvcrt.dll__write
mov dword [esp], 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
sub esp, 4
test eax, eax
je 0x41c159
mov ecx, 2
int 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], 0xc0000409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4227e0
Capabilities:
Print debug messages

Disassembly:
push edi
pxor xmm0, xmm0
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push ebx
lea ebx, [ebp - 0x41]
sub esp, 0x50
movups xmmword [ebp - 0x21], xmm0
mov eax, dword [0x4580ec]
mov dword [ebp - 0xc], eax
xor eax, eax
movups xmmword [ebp - 0x41], xmm0
movups xmmword [ebp - 0x31], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], str.Error_cleaning_up_spin_keys_for_thread__lu._n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x35
mov dword [esp], ebx
call fcn.00428120
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
lea esi, cs:[esi]
lea esi, [esi]

Function at 0x422bd0
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x458af4], 1
je 0x422c88
push edi
mov eax, 0x458af4
push esi
push ebx
sub esp, 0x10
call fcn.004225c0
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.00421eb0
mov edi, dword [0x458af4]
test edi, edi
jne 0x422c40
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x43e064], eax
cmp eax, 0xffffffff
je 0x43d2a5
mov dword [0x458af4], 1
mov dword [esp], esi
call fcn.004221e0
test ebx, ebx
je 0x422c7a
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.00422860
cmp edi, 1
je 0x422c22
mov dword [esp], 2
call dword [0x43e04c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x458af4
mov dword [esp + 4], str._once__p_is__ld_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
call fcn.004221e0
test ebx, ebx
jne 0x422c2e
add esp, 0x10
pop ebx
pop esi
pop edi
ret
ret
call sub.msvcrt.dll_abort
call sub.msvcrt.dll_abort
mov eax, dword [0x14]
ud2

Function at 0x422dc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.00422bd0
mov eax, dword [0x43e064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x422de8
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.00422c90