joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027ae
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x20], ebx
je 0x10027c1
xor eax, eax
inc eax
jmp 0x1002851
push edi
lea eax, [esi + 0x18]
push eax
push ebx
push esi
push 0x1003299
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10027e5
pop edi
pop esi
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x20], 1
push dword [esi + 0x24]
mov ecx, esi
call fcn.01002545
test eax, eax
je 0x10027ec
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x3bc
push edi
call fcn.01003ed7
cmp eax, ebx
pop ecx
je 0x1002824
push 0xa
push dword [esi + 0x14]
mov ecx, eax
call fcn.010033b7
mov dword [0x100868c], eax
jmp 0x100282a
mov dword [0x100868c], ebx
push edi
call fcn.01003ed7
cmp eax, ebx
pop ecx
je 0x1002848
push 0x11
push dword [esi + 0x14]
mov ecx, eax
call fcn.010033b7
mov dword [0x1008690], eax
jmp 0x100284e
mov dword [0x1008690], ebx
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x10030fd
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
cmp dword [ebp + 0xc], 0x201
jne 0x100323a
call fcn.01003098
test eax, eax
jne 0x100323a
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
mov ecx, 0x82
lea edi, [ebp - 0x2bc]
rep stosd dword es:[edi], eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x2bc]
push eax
call esi
lea eax, [ebp - 0x2bc]
push 0x10013b4
push eax
call fcn.01003f9b
pop ecx
pop ecx
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x4c4]
rep stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x4c4]
push eax
call esi
lea eax, [ebp - 0x4c4]
push 0x1001398
push eax
call fcn.01003f9b
lea eax, [ebp - 0x4c4]
push eax
call fcn.01003fe1
mov esi, eax
lea eax, [ebp - 0x2bc]
push eax
call fcn.01003fe1
add esi, eax
lea eax, [esi + esi + 0xa]
push eax
call fcn.01003ed7
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1003237
push 0x1001394
push esi
call fcn.01003fc5
lea eax, [ebp - 0x2bc]
push eax
push esi
call fcn.01003f9b
push 0x100138c
push esi
call fcn.01003f9b
lea eax, [ebp - 0x4c4]
push eax
push esi
call fcn.01003f9b
xor eax, eax
push 0x11
pop ecx
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov ebx, 0x1008694
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xb4]
push 0x100136c
push eax
call fcn.01003fc5
add esp, 0x28
push ebx
lea eax, [ebp - 0xb4]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x44]
push eax
xor eax, eax
push eax
push eax
push 0x400
push eax
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push esi
call fcn.01003ec9
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1003cf6
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x1001458
call fcn.01004cf4
mov edi, 0x94
mov eax, edi
call fcn.01004d40
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x10086cc], ecx
mov eax, dword [esi + 4]
mov dword [0x10086d8], eax
mov edx, dword [esi + 8]
mov dword [0x10086dc], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x10086d0], esi
cmp ecx, 2
je 0x1003d56
or esi, 0x8000
mov dword [0x10086d0], esi
shl eax, 8
add eax, edx
mov dword [0x10086d4], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1003d91
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003d91
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1003da9
cmp eax, 0x20b
je 0x1003d96
mov dword [ebp - 0x1c], esi
jmp 0x1003dbd
cmp dword [ecx + 0x84], 0xe
jbe 0x1003d91
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x1003db7
cmp dword [ecx + 0x74], 0xe
jbe 0x1003d91
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.01004ca1
pop ecx
test eax, eax
jne 0x1003de9
cmp dword [0x10086bc], 1
jne 0x1003dd6
call fcn.010043eb
push 0x1c
call fcn.01004222
push 0xff
call fcn.010040a3
pop ecx
pop ecx
mov dword [ebp - 4], esi
call fcn.01004adc
test eax, eax
jge 0x1003dfd
push 0x1b
call fcn.01003cd1
pop ecx
call fcn.01004a3d
mov dword [0x1009ad0], eax
call fcn.010048b2
mov dword [0x10086b8], eax
call fcn.0100481c
test eax, eax
jge 0x1003e22
push 8
call fcn.01003cd1
pop ecx
call fcn.010045e9
test eax, eax
jge 0x1003e33
push 9
call fcn.01003cd1
pop ecx
call fcn.010040d3
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x1003e46
push eax
call fcn.01003cd1
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call fcn.01004595
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x1003e67
movzx eax, word [ebp - 0x34]
jmp 0x1003e6a
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.01001fdb
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x1003e88
push edi
call fcn.010041e2
call fcn.01004204
jmp 0x1003eba
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.01004d2d
ret
Function at 0x1004222
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
cmp edx, dword [eax*8 + 0x1008060]
je 0x1004242
inc eax
cmp eax, 0x12
jb 0x1004233
shl eax, 3
cmp edx, dword [eax + 0x1008060]
mov dword [ebp + 8], eax
jne 0x10043e0
mov ecx, dword [0x10086bc]
cmp ecx, 1
je 0x10043b5
test ecx, ecx
jne 0x1004274
cmp dword [0x100805c], 1
je 0x10043b5
cmp edx, 0xfc
je 0x10043e0
and byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10042af
push 5
pop ecx
mov esi, 0x10017cc
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ebx, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10042be
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x10042f6
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10042d6
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x10017c8
push ebx
call fcn.01006040
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10042fb
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1008064]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1004312
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.01004d40
mov edx, esp
push 6
pop ecx
mov esi, 0x10017ac
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100433e
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100434a
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1004363
mov eax, dword [ebp + 8]
mov esi, 0x10017a8
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x1008064]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100437e
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100438a
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x1001780
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.01005f3f
add esp, 0xc
jmp 0x10043e0
mov ecx, dword [eax + 0x1008064]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10043c0
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10048b2
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x1008924]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push edi
xor ebx, ebx
xor ebp, ebp
cmp eax, ebx
push 2
mov dword [esp + 0x14], ebx
pop edi
jne 0x10048ff
call esi
mov ebp, eax
cmp ebp, ebx
je 0x10048e6
mov dword [0x1008924], 1
jmp 0x1004904
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x10048fa
mov eax, edi
mov dword [0x1008924], eax
jmp 0x10048ff
mov eax, dword [0x1008924]
cmp eax, 1
jne 0x1004964
cmp ebp, ebx
jne 0x1004917
call esi
mov ebp, eax
cmp ebp, ebx
jne 0x1004917
xor eax, eax
jmp 0x1004a20
cmp word [ebp], bx
mov eax, ebp
je 0x100492d
add eax, edi
cmp word [eax], bx
jne 0x100491f
add eax, edi
cmp word [eax], bx
jne 0x100491f
sub eax, ebp
add eax, edi
mov esi, eax
push esi
call fcn.01003f57
cmp eax, ebx
pop ecx
jne 0x100494c
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x1004a20
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, ebp
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, eax
jmp 0x100493e
cmp eax, edi
je 0x100496c
cmp eax, ebx
jne 0x1004910
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x1004910
cmp byte [ebp], bl
mov esi, ebp
je 0x10049af
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x1004910
add dword [esp + 0x10], eax
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100499e
sub eax, edi
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x100497f
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
add eax, eax
push eax
call fcn.01003f57
cmp eax, ebx
pop ecx
mov dword [esp + 0x14], eax
je 0x1004a31
cmp byte [ebp], bl
mov edi, ebp
mov esi, eax
je 0x1004a12
mov ecx, dword [esp + 0x10]
mov eax, esi
sub eax, dword [esp + 0x14]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1004a27
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10049f6
sub eax, ecx
push esi
lea edi, [edi + eax + 1]
call fcn.01003fe1
cmp byte [edi], bl
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x10049d1
push ebp
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0x14]
call fcn.01004d7d
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x1004910
Function at 0x1004a3d
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x1008928]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x1004a7d
call esi
test eax, eax
je 0x1004a62
mov dword [0x1008928], 1
jmp 0x1004a82
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1004a79
mov dword [0x1008928], 2
jmp 0x1004a8b
xor eax, eax
jmp 0x1004ad9
cmp eax, 1
jne 0x1004a86
call esi
jmp 0x1004ad9
cmp eax, 2
jne 0x1004a79
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x1004ad5
lea eax, [esi + esi]
push eax
call fcn.01003f57
mov ebp, eax
test ebp, ebp
pop ecx
je 0x1004ad5
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
je 0x1004ace
mov eax, ebp
jmp 0x1004ad7
push ebp
call fcn.01004d7d
pop ecx
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x1005f3f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1008934], ebx
push esi
push edi
jne 0x1005fbf
push 0x100184c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1005ffa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001840
push edi
call esi
test eax, eax
mov dword [0x1008934], eax
je 0x1005ffa
push 0x1001830
push edi
call esi
push 0x100181c
push edi
mov dword [0x1008938], eax
call esi
cmp dword [0x10086cc], 2
mov dword [0x100893c], eax
jne 0x1005fbf
push 0x1001800
push edi
call esi
test eax, eax
mov dword [0x1008944], eax
je 0x1005fbf
push 0x10017e8
push edi
call esi
mov dword [0x1008940], eax
mov eax, dword [0x1008940]
test eax, eax
je 0x1006004
call eax
test eax, eax
je 0x1005feb
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1008944]
test eax, eax
je 0x1005feb
test byte [ebp - 8], 1
jne 0x1006004
cmp dword [0x10086d8], 4
jb 0x1005ffe
or byte [ebp + 0x12], 0x20
jmp 0x1006023
xor eax, eax
jmp 0x1006033
or byte [ebp + 0x12], 4
jmp 0x1006023
mov eax, dword [0x1008938]
test eax, eax
je 0x1006023
call eax
mov ebx, eax
test ebx, ebx
je 0x1006023
mov eax, dword [0x100893c]
test eax, eax
je 0x1006023
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1008934]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10065e1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x10099a8]
push ebx
push esi
push edi
jae 0x1006766
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x10099c0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x14], ebx
je 0x1006766
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
jne 0x1006635
xor eax, eax
jmp 0x100677a
test al, 0x20
je 0x1006646
push 2
push edi
push edi
push ecx
call fcn.01006ccb
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1006702
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp + 8], edi
jbe 0x100673a
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x418]
cmp ecx, dword [ebp + 0x10]
jae 0x100669c
mov edx, dword [ebp - 4]
inc dword [ebp - 4]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x100668d
inc dword [ebp - 0x10]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x14]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x1006672
mov edi, eax
lea eax, [ebp - 0x418]
sub edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10066dc
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], eax
cmp eax, edi
jl 0x10066e5
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x1006666
jmp 0x10066e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
xor edi, edi
mov eax, dword [ebp - 8]
cmp eax, edi
jne 0x1006761
cmp dword [ebp + 8], edi
je 0x100673a
push 5
pop eax
cmp dword [ebp + 8], eax
jne 0x100672f
mov dword [0x10086c4], eax
jmp 0x100676d
push edi
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1006724
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], edi
mov dword [ebp - 8], eax
jmp 0x10066e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x10066e7
push dword [ebp + 8]
call fcn.01006bb6
pop ecx
jmp 0x1006777
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x100674f
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
je 0x100662e
mov dword [0x10086c0], 0x1c
mov dword [0x10086c4], edi
jmp 0x1006777
sub eax, dword [ebp - 0x10]
jmp 0x100677a
and dword [0x10086c4], 0
mov dword [0x10086c0], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40145a
Capabilities:
Parse pe header

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
test ebp, ebp
push edi
je 0x40156c
cmp word [ebp], 0x5a4d
jne 0x40156c
mov esi, ebp
add esi, dword [ebp + 0x3c]
cmp dword [esi], 0x4550
jne 0x40156c
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push dword [esi + 0x50]
push dword [esi + 0x34]
call edi
mov ebx, eax
test ebx, ebx
jne 0x4014b9
push 4
push 0x2000
push dword [esi + 0x50]
push eax
call edi
mov ebx, eax
test ebx, ebx
je 0x40156c
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
xor eax, eax
push 4
push 0x1000
mov dword [edi + 4], ebx
mov dword [edi + 0xc], eax
mov dword [edi + 8], eax
mov dword [edi + 0x10], eax
push dword [esi + 0x50]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x1000
push dword [esi + 0x54]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esi + 0x54]
mov dword [esp + 0x14], eax
add ecx, dword [ebp + 0x3c]
push ecx
push ebp
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp + 0x3c]
mov ecx, dword [esp + 0x20]
add eax, ecx
push edi
push esi
mov dword [edi], eax
push ebp
mov dword [eax + 0x34], ebx
call fcn.0040157a
mov eax, ebx
add esp, 0x18
sub eax, dword [esi + 0x34]
je 0x401537
push eax
push edi
call fcn.004016e4
pop ecx
pop ecx
push edi
call fcn.0040175e
test eax, eax
pop ecx
je 0x401565
push edi
call fcn.00401627
mov eax, dword [edi]
pop ecx
mov eax, dword [eax + 0x28]
test eax, eax
je 0x401573
add eax, ebx
test eax, eax
je 0x401565
push 0
push 1
pop esi
push esi
push ebx
call eax
test eax, eax
jne 0x401570
push edi
call fcn.00401880
pop ecx
xor eax, eax
jmp 0x401575
mov dword [edi + 0x10], esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40157a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], 0
push esi
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 8], ecx
movzx ecx, word [eax + 0x14]
cmp word [eax + 6], 0
lea esi, [ecx + eax + 0x18]
jbe 0x401624
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add esi, 0x10
mov ebx, 0x1000
cmp dword [esi], 0
jne 0x4015e5
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
test eax, eax
mov dword [ebp - 0xc], eax
jle 0x40160e
push 4
push ebx
push eax
mov eax, dword [esi - 4]
add eax, dword [ebp - 8]
push eax
call edi
push dword [ebp - 0xc]
mov dword [esi - 8], eax
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
jmp 0x40160e
mov eax, dword [esi - 4]
push 4
add eax, dword [ebp - 8]
push ebx
push dword [esi]
push eax
call edi
mov ecx, dword [esi + 4]
push dword [esi]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push ecx
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi - 8], eax
mov eax, dword [ebp + 0x10]
inc dword [ebp - 4]
add esi, 0x28
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 4], eax
jl 0x4015b3
pop edi
pop ebx
pop esi
leave
ret
Function at 0x46629b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp], ecx
lea esp, [esp + 0x24]
jb 0x49ac08
xchg dh, al
das
cmp ch, bl
movzx eax, byte [ebp - 2]
bts dx, 1
bswap edx
shrd edx, eax, 0xe
shr eax, 5
ror dl, cl
cmc
rcl dx, 8
pushal
imul eax, eax, 0x300
pushal
cmc
lea eax, [ebx + eax*4 + 0x94d8]
sar dx, cl
mov dword [esp + 0x3c], ecx
cmp ecx, 0x3f9effe0
ror dh, cl
mov dword [esp + 0x38], ebx
shld ebx, ecx, cl
bts bx, 2
mov ebx, eax
bsf dx, ax
rcr dh, 2
mov edx, 1
jmp 0x4a6899
test ah, 0xac
stc
cmp ecx, 7
pushfd
call fcn.004a5fce
add byte [eax], al
push ebx
je 0x4a68ff
arpl word [edx + 0x6f], si
insb byte es:[edi], dx
insb byte es:[edi], dx
push eax
outsd dx, dword [esi]
jae 0x4a68b5
clc
push 0x6411f7d4
or edx, edx
jmp 0x4a7b90
pushal
lea esp, [esp + 0x28]
je 0x49a971
test cl, bl
call fcn.00465366
push esp
and al, 4
push dword [esp + 0xc]
lea esp, [esp + 0x34]
jne 0x468e8a
xor dl, ah
mov ch, ah
adc edx, ecx
mov dword [ebp - 0x1c], edi
test dl, 0x61
test al, cl
bsr di, ax
mov dh, bh
mov edi, dword [ebp + 0xc]
xadd ecx, edx
mov edx, ebp
xor eax, eax
ror dh, cl
add dl, cl
mov byte [ebp - 2], al
shl ecx, 0x1a
or dh, 0xc5
mov cl, bh
btr dx, 0xd
mov ecx, eax
sar dx, 0xc
inc dx
cmc
mov dword [ebp - 0x20], eax
sub dx, 0xd68f
bsr dx, di
mov dword [ebp - 0x24], eax
cmc
mov dl, 0x1b
bt ebp, 3
mov dword [ebp - 0x28], eax
cmp di, cx
jmp 0x4a7495
call fcn.004a4a51
add byte [eax], al
push ebx
popal
inc cx
jb 0x4a7515
popal
jns 0x4a74e9
jb 0x4a750d
popal
je 0x4a7510
add byte [eax - 0x63f7dbbc], cl
lea esp, [esp + 0x30]
call fcn.00497bd1
call fcn.004979fc
sbb ah, bh
jmp dword [eax - 0x64]
jb 0x4a754c
inc ebp
outsb dx, byte [esi]
je 0x4a7555
jb 0x4a74f2
add byte [eax], al
dec ecx
insd dword es:[edi], dx
popal
dec esp
imul esi, dword [ebx + 0x74], 0x7465475f
dec ecx
arpl word [edi + 0x6e], bp
push ebx
imul edi, dword [edx + 0x65], 0xc86e900
invalid
jae 0x4a7577
jb 0x4a7547
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
invalid
Function at 0x468b31
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jb 0x4903c6
pushfd
bsf ax, di
btc ax, 0xf
cmp cx, bp
mov eax, 6
pushfd
sub ecx, eax
push 0x5a9ea06a
not al
jmp 0x4a4e1b
jb 0x46a027
clc
cmc
cmp byte [edi - 1], 0
call fcn.004981a6
salc
rol edx, 1
stosb byte es:[edi], al
invalid
mov al, byte [ebp - 2]
mov byte [esp + 8], al
call fcn.00499028
out 0x10, eax
jg 0x4a4e42
invalid
jp 0x4a4e5a
xor ebx, edx
nop
stosd dword es:[edi], eax
jl 0x4a4ec3
jo 0x4a4e58
loop 0x4a4e99
xchg esp, eax
daa
in eax, 0x5e
aad 0x8b
xor al, 0x59
jb 0x4a4e63
adc al, 0xd1
ficomp dword [ebx - 0x8c1c2dc]
adc byte [ecx + 0x29f84f8a], cl
retf 0x30ff
dec edi
clc
sub edx, ecx
push dword [eax]
mov al, 0x53
test al, 0x22
lahf
adc ebx, dword [ebx]
std
dec ecx
loop 0x4a4e7e
std
jae 0x4a4ea8
and bh, 0xe0
mov cl, 0x6e
imul ebx, esp, 0x37
aaa
jo 0x4a4eda
sbb dh, byte [ebx]
sub dword [esp + 0x59], 0x57
or eax, 0xbd21cee6
push eax
cld
pop es
sub edi, esp
dec eax
bound edx, qword [ebp + 0x49d844ad]
lodsd eax, dword [esi]
inc esp
fmul dword [ecx - 0x1e]
dec ebp
dec ecx
loop 0x4a4ee9
mov ecx, dword [eax - 0x7a]
sub dword [ebp - 0x706321ca], ebx
sbb eax, 0x876cae1d
mov ebp, 0xcf116473
insb byte es:[edi], dx
xchg dword [ebp - 0x30ee9b8d], edi
xor byte [edx - 0x1af540bc], bh
enter 0xfffffffffffff323, 0xc
into
je 0x4a4ee6
cmc
or edx, ebx
cmc
stosd dword es:[edi], eax
dec esp
xor ecx, ebp
sub eax, 0x8fd1ccac
jo 0x4a4eee
int 0x2d
lodsb al, byte [esi]
int3
and ah, byte [edi]
mov dh, 0x1d
add byte [ebx], ah
jl 0x4a4f0d
sub eax, 0x566b98e2
test eax, 0x1dea8655
push esp
pop edi
sbb dh, byte [ebp - 0x65d64345]
or byte [ebx - 0x35261a06], dh
xchg dl, ch
sbb eax, 0xb51a5f54
mov ebx, 0x89a29bc
mov bl, 0xfa
in eax, 0xd9
retf 0x8c43
fxch st(2)
inc ebx
mov word [edx - 0x53], gs
lodsd eax, dword [esi]
loop 0x4a4f3b
adc dword [esi], 0xafe2395c
insd dword es:[edi], dx
dec esi
jo 0x4a4e96
in eax, dx
push ss
aad 0
add byte [ebx + 0x72], al
popal
je 0x4a4f6b
dec ecx
arpl word [edi + 0x6e], bp
add byte [edi], cl
invalid
xchg ebx, eax
les edi, [eax + 3]
call fcn.00469a65
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x4a4f85
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax - 0x17], si
sub eax, 0x9cffffc1
lea esp, [esp + 0xc]
je 0x4985be
pushfd
push dword [esp]
mov byte [esp], 0x14
push 0x8e0213fb
lea esp, [esp + 0xc]
jmp fcn.004985de
lea esp, [esp + 0x34]
ja 0x468d3a
jmp 0x4a3f05
pushal
call fcn.00497b07