joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41723e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x42b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00412ea0
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00412ea0
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x4172b5
cmp word [ecx], dx
je 0x4172b5
mov eax, dword [0x4249a4]
push edi
dec eax
push eax
push 0x424890
call fcn.004171dd
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x417328
cmp word [eax], dx
je 0x417328
mov eax, dword [edi]
test eax, eax
je 0x4172d9
cmp word [eax], dx
je 0x4172d9
lea eax, [ebp - 0x10]
push eax
call fcn.00416bc0
jmp 0x4172e2
lea eax, [ebp - 0x10]
push eax
call fcn.00416c5b
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x417352
mov eax, dword [0x42488c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x424580
call fcn.004171dd
add esp, 0xc
test al, al
je 0x417352
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x41731d
cmp word [eax], di
je 0x41731d
lea eax, [ebp - 0x10]
push eax
call fcn.00416bc0
pop ecx
jmp 0x417354
lea eax, [ebp - 0x10]
push eax
call fcn.00416c5b
jmp 0x41731a
mov eax, dword [edi]
test eax, eax
je 0x41733f
cmp word [eax], dx
je 0x41733f
lea eax, [ebp - 0x10]
push eax
call fcn.00416b75
pop ecx
jmp 0x417352
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x41741d
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00417062
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41741d
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x41741d
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x41741d
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4173aa
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.00417a65
test ebx, ebx
je 0x417418
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.00417a65
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41741d
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41741d
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0041cce7
add esp, 0x10
xor eax, eax
inc eax
jmp 0x41741f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406861
leave
ret
Function at 0x417868
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4259b8
push 0x4259b0
push str.FlsAlloc
push 0x1f
call fcn.004176d3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41789c
push dword [ebp + 8]
mov ecx, esi
call dword [0x420178]
call esi
jmp 0x4178a2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4178e6
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4259c8
push 0x4259c0
push str.FlsGetValue
push 0x21
call fcn.004176d3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41791d
push dword [ebp + 8]
mov ecx, esi
call dword [0x420178]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x417925
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4259d0
push 0x4259c8
push str.FlsSetValue
push 0x22
call fcn.004176d3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41795f
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x420178]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41a55a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0041f140
mov eax, dword [0x42b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004191a1
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41a59c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41a6f8
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041f170
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x42d5c0]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.0041b557
mov ecx, dword [esi*4 + 0x42d5c0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x41a6f1
cmp eax, dword [ecx + edi + 0x24]
jne 0x41a6f1
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41a6f1
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041b557
add esp, 0x14
test edx, edx
jl 0x41a6f1
jg 0x41a667
test eax, eax
jb 0x41a6f1
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41a6f1
jl 0x41a681
cmp dword [ebp - 0x1008], eax
ja 0x41a6f1
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41a69f
test ebx, ebx
je 0x41a6d8
cmp ecx, edi
jae 0x41a6d8
mov al, byte [ecx]
cmp al, 0xd
jne 0x41a6b9
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41a6c5
cmp byte [ecx + 1], 0xa
jne 0x41a6c5
inc ecx
jmp 0x41a6c5
movzx eax, al
movsx eax, byte [eax + 0x42b810]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41a69f
cmp edx, ebx
jne 0x41a69f
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41a6f6
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00406861
leave
ret
Function at 0x41a9ef
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x42d5c0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41aa2f
cmp byte [ebx], 0xa
jne 0x41aa2f
or byte [edi + eax + 0x28], 4
jmp 0x41aa34
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x41ab33
mov dl, byte [eax]
cmp dl, 0x1a
je 0x41ab16
inc eax
cmp dl, 0xd
je 0x41aa60
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x41aa86
cmp eax, ecx
jae 0x41aa94
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41aa48
jmp 0x41ab33
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ab11
cmp dword [ebp - 0x10], 0
je 0x41ab11
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x42d5c0]
test byte [eax + edi + 0x28], 0x48
je 0x41aaeb
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41aad6
mov byte [esi], dl
jmp 0x41aae7
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x42d5c0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41ab33
cmp byte [ebp - 1], 0xa
jne 0x41aafa
cmp esi, ebx
jne 0x41aafa
mov byte [esi], 0xa
jmp 0x41ab32
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041b575
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41ab33
mov byte [esi], 0xd
jmp 0x41ab32
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x42d5c0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41ab30
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41ab33
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41ab3c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x42d5c0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41ab82
cmp word [ebx], dx
jne 0x41ab82
or byte [eax + edi + 0x28], 4
jmp 0x41ab87
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x41acea
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x41acca
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41abc8
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41abfe
cmp eax, edx
jae 0x41ac0c
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x41aba3
jmp 0x41acea
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41acc5
cmp dword [ebp - 0x18], 0
je 0x41acc5
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x42d5c0]
test byte [eax + edi + 0x28], 0x48
je 0x41ac9b
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41ac5f
mov word [esi], cx
jmp 0x41ac96
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x42d5c0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x42d5c0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x42d5c0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x41acea
pop eax
cmp word [ebp - 4], ax
jne 0x41acab
cmp esi, ebx
jne 0x41acab
mov word [esi], ax
jmp 0x41ace7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041b575
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x41acea
push 0xd
pop eax
jmp 0x41aca6
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x42d5c0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x41ace4
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x41acea
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41f100
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f12d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f12d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0xb62819
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt sp, si
jmp 0xb64369
lahf
call fcn.00b6b715
jmp 0xb6d835
lea esp, [esp + 8]
je fcn.00b66f17
jmp 0xb626bb
cmp dword [ebp - 0x11c], 0
push edi
lea esp, [esp + 4]
jne 0xb64642
sar dx, 6
shl dh, cl
cmc
call 0xb64387
mov dword [esp], 4
bswap dx
adc dl, al
bsf dx, di
push 0x3000
movsx dx, dl
add edx, 0xd6393a33
mov edx, dword [ebp - 0xc]
bt bp, 8
shl edx, 1
pushfd
push eax
pushfd
mov dword [esp + 8], edx
pushal
call fcn.00b62750
pushfd
mov dword [esp + 0x20], 0x8000
pushfd
push 0xc391e31c
call fcn.00b67c8b
jne 0xb6171e
pushal
jmp 0xb66923
clc
mov dword [ebp - 0x11c], eax
cmc
cmp eax, 0xea
jmp 0xb674ac

Function at 0xb63fae
Capabilities:
Get number of processors

Disassembly:
push ebp
push dword [ebp - 0x10c]
pop dword [esp + 0x28]
pushfd
mov byte [esp], 0x16
pushfd
push dword [esp]
mov dword [esp + 0x30], 0xb66356
call fcn.00b6d107
stc
clc
cmp edx, 0x4c
call fcn.00b66d90

Function at 0xb659fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp ebx, eax
cmc
xor ecx, ecx
shr cl, cl
clc
mov cl, byte [eax + 9]
cmp dl, 0xe0
push esi
cmp ecx, 0x6c
push 0x681b1990
push dword [esp]
push 0xdf63ea45
lea esp, [esp + 0x14]
je 0xb61a21
sal dx, 1
mov dh, 0xcb
inc edx
jmp 0xb66fcd

Function at 0xb6663c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push dword [esp]
lea esp, [esp + 0x38]
je 0xb671df
rcl ch, cl
and ah, bh
rol ah, 3
mov eax, dword [ebp - 0x100]
sar cx, cl
mov ecx, dword [eax + 0x30]
clc
xor edx, edx
ror dh, 5
mov dx, word [ecx + 6]
clc
cmp edx, 0x4c
push 0xeed28daa
push ecx
call fcn.00b6589b
jmp 0xb6529d

Function at 0xb672bd
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
not eax
add ebx, dword [ebp - 0xbc]
aas
aas
bswap cx
mov dword [edx], ebx
pop eax
dec cl
sbb cl, ch
xor byte [edx - 1], 0x80
sar cx, cl
shl dh, 3
mov eax, dword [ebp - 0xac]
lea ebx, [eax - 0x62a88f19]
shld cx, bp, cl
add eax, 0x10002395
shrd cx, cx, 0xd
neg bl
sal dl, cl
not cl
mov dword [ebp - 0xb0], eax
sar eax, 0xa
mov byte [esp], 0xba
rcr ax, cl
pushfd
push dword [esp + 8]
popfd
xchg ah, cl
pop eax
cwde
add esp, 8
popal
or ah, ah
xor ax, 0x9277
mov eax, dword fs:[0x30]
clc
mov eax, dword [eax + 0xc]
test bh, 0x94
test eax, eax
push 0x2af6bb7b
lea esp, [esp + 4]
je 0xb68704
jmp 0xb64471
Function at 0xb67c99
Capabilities:
Get number of processors

Disassembly:
inc eax
sar ch, cl
mov eax, dword [ebp - 0x100]
cmc
sar cx, 0xf
sal ecx, cl
sbb cl, 0xc4
mov ecx, dword [eax + 0x30]
test ah, dl
sub edx, edx
pushfd
stc
push dword [esp]
clc
mov dx, word [ecx + 0xe]
cmc
cmp edx, 0x6c
mov byte [esp], 0xd4
mov byte [esp + 4], 0xac
lea esp, [esp + 8]
je 0xb69af1
not cl
bts ax, 8
mov eax, dword [ebp - 0x100]
bswap cx
movsx cx, dl
shld cx, bx, cl
mov ecx, dword [eax + 0x30]
mov eax, dword [ebp - 0x100]
test bh, 0x96
mov ecx, dword [eax + 0x30]
pushfd
push 0xe2ad3f4c
sub edx, edx
rcl dh, 4
mov dx, word [ecx + 0xc]
pushfd
bt di, bp
cmp edx, 0x64
lea esp, [esp + 0xc]
jo 0xb6446b
push 0xefe2db0f
lea esp, [esp + 4]
je 0xb61612
xchg ah, cl
pushal
bswap ecx
mov eax, dword [ebp - 0x100]
btr cx, 1
add cx, dx
pop ecx
push esp
mov ecx, dword [eax + 0x30]
mov byte [esp], 0x10
xor edx, edx
bts dx, si
setb dh
rcl dl, cl
mov dx, word [ecx + 0xc]
call fcn.00b63727
push dword [esp + 8]
push dword [ebp - 0x128]
pop dword [esp + 0x20]
pushfd
pushal
call fcn.00b66e65
mov dword [ebp - 0x70], 1
lea esp, [esp + 0x20]
call fcn.00b69a53
lea esp, [esp + 8]
jne 0xb6d13a
add cx, ax
sbb ch, 0xb
add cx, bp
jmp 0xb632e2
push ebx
call fcn.00b63977
add al, ch
mov eax, dword fs:[0x30]
bsf dx, cx
rol cl, cl
sar dh, 4
mov eax, dword [eax + 0xc]
call fcn.00b6880f
pushfd
lea esp, [esp + 0x14]
je 0xb63fe4
pushal
mov byte [esp], 2
jmp 0xb63fd9

Function at 0xb6c384
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
pushal
cmp bx, 0xde53
cmp edx, 0x6c
pushal
mov byte [esp], 0xa6
pushfd
lea esp, [esp + 0x48]
je 0xb6494a
cwde
cmc
daa
aas
mov eax, dword [ebp - 0x104]
stc
add ecx, 0x690b6706
mov ecx, dword [eax + 0x30]
pushfd
pushal
bt sp, ax
xor edx, edx
inc dx
mov dx, word [ecx + 0x16]
jmp 0xb63fcf

Function at 0xb6c92c
Capabilities:
Execute anti-debugging instructions

Disassembly:
and ch, 0xd8
add ch, 0xf5
setne dh
mov edx, dword [ebp - 0xac]
test ebx, 0x78053dfb
add edx, 0x10002464
bsf cx, di
rcr cl, cl
clc
sub eax, eax
call fcn.00b6a67b
lea esp, [esp + 0x10]
je 0xb6d152
btc ax, 6
mov dword [ebp - 0x12c], 0
push esp
mov eax, dword [ebp - 0x38]
lea edx, [esp - 0x2f5be100]
push dword [esp]
imul eax, eax, 0x14
movzx dx, cl
cmp bh, 8
mov ecx, dword [ebp - 0x40]
bsr edx, edx
rol dx, cl
inc dl
ror dx, 9
mov edx, dword [ecx + eax + 0xc]
aad 0x1f
lahf
pushal
cmp di, 0xd153
add edx, dword [ebp - 0xbc]
clc
mov dword [ebp - 0x44], edx
bts cx, 0xf
mov eax, dword [ebp - 0x38]
not dl
imul eax, eax, 0x14
call fcn.00b64e2f
cmc
clc
stc
clc
cmp dword [ebp - 0x6c], 0
push 0x4152e0f1
lea esp, [esp + 4]
je 0xb69ec5
cdq
push 0x90ceb41f
jmp fcn.00b64b95

Function at 0xb6ccbb
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
je 0xb6af71
stc
pushal
cmp bl, 0x4c
pushal
call fcn.00b6348a
jmp 0xb627e7
Function at 0x432005
Capabilities:
Encode data using xor

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x853c23
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x3f51c14
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Accept command line arguments
Check os version
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x7e]
push edi
push eax
mov word [ebp - 0x80], di
call fcn.0040e860
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 2
push edi
lea eax, [ebp - 0x80]
push eax
call esi
test eax, eax
je 0x401e01
mov eax, dword [ebp + 8]
mov dword [ebx + 0xc], 0xe8000002
invalid
Function at 0x406b15
Capabilities:
Terminate process

Disassembly:
push 0x74
push edi
add esi, eax
push 1
mov edx, dword [eax + 0x40]
pop esi
push 0x455aa0
sub eax, 5
je 0x406b82
call dword [eax + 0xc]
test ecx, ecx
add eax, 0xaf2
mov cl, byte [ebp - 0xc]
mov byte [ebp + eax - 0x1700030c], 0xfc
sbb eax, 0x8359ffff
les ecx, [eax + ebp*2]
nop
stc
inc ebp
add byte [ebp + 0x43899c45], cl
add byte [ecx + 0x42a004], ah
xor eax, ebp
mov dword [ebp - 4], eax
push 0x83e
lea eax, [ebp - 0x843]
push 0
push eax
mov byte [ebp - 0x844], 0
call fcn.0040e860
add esp, 0xc
xor eax, eax

Function at 0x406c40
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a004]
jne 0x406c4a
repz ret
jmp fcn.004072f0

Function at 0x40839c
Capabilities:
Get thread local storage value

Disassembly:
mov dword [ebp - 4], eax
call fcn.00407fb0
mov eax, dword [0x42a010]
push eax
mov ecx, dword [0x42a014]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
mov dword [ebp - 8], eax
inc ebp
clc
Function at 0x41c310
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41c316
ret

Function at 0x4278b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x427a61
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404af4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x427a78
call fcn.00404750
mov eax, ebx
call fcn.0041a29c
mov edi, eax
dec edi
test edi, edi
jl 0x427968
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041a270
mov edx, dword [0x42c1c8]
call fcn.00403880
test al, al
je 0x427964
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041a270
lea edx, [ebp - 0x14]
call fcn.00436270
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404af4
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004047c4
inc esi
dec edi
jne 0x427916
mov al, byte [0x427a7c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x427a88
mov eax, dword [ebp - 0xc]
call fcn.0040d008
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004044dc
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00436270
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x427a78
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00436270
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x427a78
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x427a78
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x427a94
call fcn.00409310
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427a68
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404468
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404468
lea eax, [ebp - 0x14]
call fcn.00404444
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404468
ret