joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411980
Capabilities:
Encode data using xor

Disassembly:
and al, 0x40
sub byte [esp + eax*2 - 0x3d74a0dc], bh
and byte [ecx], al
add esi, eax
inc esp
lodsd eax, dword [esi]
into
sub ecx, dword [ebp - 0x9bd2e5e]
fisttp qword [esi]
je 0x411872
cmc
pushfd
and eax, dword [eax + 0x3c]
stc
cmp al, 0xf9
add byte [eax], dh
xor edi, dword [edx]
invalid
push edx
invalid
js 0x411853
dec eax
push eax
pop esi
invalid
dec ebp
in eax, 0x3f
push esp
and al, 0xf8
mov bl, 0x8b
push ebp
dec eax
dec eax
mov eax, dword [ebx + edi*8 - 0x25]
push ebx
push ecx
xor al, 0x64
push eax
call int.004161a3
pop eax
fldenv [eax + eax]
jg 0x4118d9
add byte [ebx - 0x74a05c19], al
notrack call ds:[ebx + 0x33]
arpl word [edi + 0x3ed9cb80], bp
mov esp, ebp
cmpsb byte [esi], byte es:[edi]
inc ebx
sbb al, 0
sub al, 0xe9
push ebp
mov eax, esi
imul esp, esp, 0xffffffb8
in al, 0xb8
loop 0x41198b
dec esp
mov eax, dword [0x498439]
mov dl, 0x6e
mov dword [eax + edi - 0x3e], eax
mov eax, dword [ebp + 0x7e]
sti
mov ebx, dword [ebp + 0x16]
jbe 0x4118b8
jne 0x4118ca
out 0x50, eax
push 0x479c30
xor byte [ecx - 0x5a5fe7dc], ah
push eax
mov ebp, ebp
jle 0x4118cc
xlatb
enter 0xffffffffffff8b42, 0x55
ja 0x4118e3
mov eax, dword [ebp + 0x1d]
cmp cl, byte [esp - 0x21]
out 0x8b, al
dec ebp
enter 0xffffffffffff99f4, 0x74
xchg ebp, eax
push edi
call 0xc0f96d4d
sbb eax, 0x9384246e
mov ss, word [eax]
sbb dh, byte [edx + 0x77]
pop edi
mov ebx, esp
int 2
lodsb al, byte [esi]
inc dword [edx + 0x14]
retf
push ebp
mov ebx, dword [edi + 0x31d1179a]
jecxz 0x411914
int1
add dl, byte [ecx]
cmp al, 0xd3
adc dword [ebx + edx*8], edi
scasd eax, dword es:[edi]
loop 0x4119a5
cmp esi, 0x3b
pop ds
movsd dword es:[edi], dword [esi]
aaa
inc edx
jmp 0x41199c
wait
push ds
or al, byte [ebx + 0x658dfdf9]
or dl, byte [eax + edi*8 + 2]
mov edi, dword [edi - 0x41]
push edi
jmp 0xd37c4a34
Function at 0x411dd0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46abfb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x496d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x46f604
call fcn.0043df02
push 4
mov dword [ebp - 4], 0
call fcn.0044e9d2
mov edi, eax
add esp, 4
test edi, edi
je 0x411e50
call fcn.0043a1b1
mov dword [edi], eax
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00439fa0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x411e46
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00439fc8
jmp 0x411e52
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419b30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [0x3a50fc]
push 0xf083f
push 0
push 0
push 0x10
dec ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
invalid

Function at 0x42b5d0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c3fc
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x496d50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x49
xor eax, eax
xor esi, esi
push 0x48cc50
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], esi
mov word [ebp - 0x248], ax
call fcn.00401740
mov dword [ebp - 4], esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x284], edi
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x27c], esi
mov byte [ebp - 4], 1
Function at 0x42d3d0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x496d50]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push 1
push edi
push edi
mov esi, ecx
mov dword [ebp - 0x24], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x28], ebx
test ebx, ebx
jne 0x42d416
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044e488
mov esp, ebp
pop ebp
ret
push 0x24
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x42d431
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42d501
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push edi
call esi
cmp dword [ebp - 0x1c], 4
jne 0x42d4f7
lea ecx, [ebp - 0x20]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x42d46a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
jne 0x42d4fa
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x2c], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [ebp - 0x20]
push edx
push edi
call esi
test eax, eax
je 0x42d4e8
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 1
je 0x42d4e4
cmp dword [ebp - 0x2c], 0
je 0x42d4af
mov esi, dword [ebp - 0xc]
mov ebx, ecx
mov dword [ebp - 0x2c], 0
jmp 0x42d4c3
cmp ebx, ecx
je 0x42d4ba
mov esi, dword [ebp - 0xc]
mov ebx, ecx
jmp 0x42d4c3
mov eax, dword [ebp - 0xc]
cmp eax, esi
jbe 0x42d4e8
mov esi, eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x20]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x42d493
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42d4f7
test eax, eax
jne 0x42d4f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42d4f7
mov dword [ebp - 0x24], 1
mov ebx, dword [ebp - 0x28]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e488
mov esp, ebp
pop ebp
ret
Function at 0x436bf0
Capabilities:
Encode data using xor

Disassembly:
or al, bl
inc ecx
stosb byte es:[edi], al
dec ebx
je 0x436b28
scasd eax, dword es:[edi]
imul eax, dword [esi], 0x9eba0ef4
mov byte [edx + eax + 0x67743b00], cl
mov word [edx], es
add byte [ebx], bh
je 0x436c03
sbb ecx, dword [ebx - 0x7ffeb2ab]
pop edi
push 0x7b67845e
inc eax
seto byte [esi + 3]
sal byte [edx + 0x48547c35], cl
push eax
xor al, byte [eax - 0x6f]
xchg esi, eax
mov edx, dword [edx + esi - 0x7ffffef5]
fld qword [ecx + eax*8 + 0x45]
cmc
mov cl, 0x10
cli
pop ebp
add byte [ebx - 0x7c29d2b4], ch
jge 0x436b96
pop edi
add eax, dword [ecx]
mov dh, byte [ebx]
dec ecx
faddp st(5)
pop esi
invalid
push ebp
or ebx, dword [edx + 0x57]
or ecx, dword [ebp - 0x57]
dec ebp
or al, 0x28
push edi
push ecx
ja 0x436c41
push edi
mov es, word [ecx]
je 0x436b89
wait
dec ebp
adc al, 0xa6
adc byte [ebp + 0x10], dl
aam 0xea
push eax
mov esp, ebp
sub edx, dword [eax - 0x73]
mov eax, 0x6af5e8b7
dec ecx
add byte [ebx + 0x18c4e933], cl
and bl, ch
mov eax, esi
test dword [ecx - 0x1b], edi
pop ebp
cmpsb byte [esi], byte es:[edi]
mov dword es:[eax], 0x7400e43c
mov bl, 0x88
dec ebp
adc byte [eax - 1], bl
push ebp
adc al, 0xdc
fist dword [ebp + 8]
cmc
and eax, 0x74dd8d52
push eax
je 0x436c93
call fcn.004371cd
invalid

Function at 0x43dccb
Capabilities:
Encode data using xor

Disassembly:
clc
aad 0x15
xchg ah, bh
adc eax, 0x6651001e
sbb dword [ebx + 0x1c], ecx
or al, 0x80
adc byte [edx + 0x1c1e05ff], bh
xchg ebp, eax
test byte [ecx], dh
cmp ax, word [ecx]
inc edx
jnp 0x43dc0b
add dword [ebx], edx
push esi
mov ebx, dword [ebp + 0x10490074]
add dword [ebp + 0x270e82f6], eax
jg 0x43dc11
sbb al, 0xca
jae 0x43dca2
xor dword [ebp - 0x41], esi
mov dword [edx], edx
cli
sbb edi, ebx
stosb byte es:[edi], al
ret 0x721
movzx edi, ax
mov byte [0xa0206e2d], al
inc ebp
cld
jb 0x43dcc6
enter 0x45, 0xffffffffffffff90
push eax
push edx
inc eax
test dh, dl
jo 0x43dcb9
add byte [ebx - 0x15afc23c], al
add edx, eax
or byte [eax], 0x74
lodsb al, byte [esi]
hlt
inc esi
mov esp, 0x8bc30906
mov edx, dword [ecx + 0x52]

Function at 0x43e01c
Capabilities:
Encode data using xor

Disassembly:
xchg dword [edx + esi*2 + 0x2d], edi
mov edi, edi
add dl, al
in al, dx
mov esp, dword [0xbe56531c]
and byte [ebx + ebp], cl
jnp 0x43e074
push edi
mov edx, dword [eax + 0x127d2b82]
movsd dword es:[edi], dword [esi]
sal byte [ebp + 0x54], 0xd4
jmp 0x8b4b8f4c
Function at 0x4504ad
Capabilities:
Encode data using xor

Disassembly:
pop edi
pop esi
jb 0x4504e6
push ebx
call fcn.00459b20
call 0x898c532d
xchg bh, al
add byte [0x31000056], dh
imul ebx, dword [ebx + 0x5d], 0xffffffcb
adc bh, bh
push ebp
dec ecx
push 0x56c1558b
mov ebx, dword [ebp + 0x23]
ficom word [edi - 0x7b]
lds esp, [0x75d28510]
adc byte [ecx], bh
xchg byte [ecx + 0x75], dl
adc al, byte [esi - 0x49a1a084]
ja 0x450492
cmp dword [esi - 0x79ed8aaf], eax
jl 0x45052a
pop esi
mov dh, 0x77
ret
test ecx, ebp
xor eax, 0xa1e38b07
test edi, edi
popfd
jno 0x4504c3
adc dword [ecx + 0x2f], eax
add byte [edx + 0x53], ch
invalid
mov dword [eax], esi
and al, 0x82
mov byte [eax], al
add byte [ebx - 0x2ca0143a], cl
invalid
and byte [ebp + 0x4b057e37], bh
sub edx, dword [eax - 0x4c79285d]
add byte [esi + ecx], al
push ss
push es
add byte gs:[ecx - 0x1570d88c], dh
or esp, ebx
xchg ebx, eax
add ecx, esi
sub edi, dword [ebp - 0x2bb340a6]
sbb cl, byte [ecx + 0x12140e08]
je 0x450547
invalid
mov edi, 0x891ad44c
or byte [esi], cl
adc al, 0x12
mov al, byte [0x67417f0]
stosd dword es:[edi], eax
mov ch, 2
or al, byte [eax]
add byte [ebp + 0x33b414db], al
leave
mov byte [0xb8508b7], al
test dword [ebx], ecx
aaa
mov cl, ch
dec edi
mov bh, 0xff
xor edi, dword [eax - 0x2413043c]
jne 0x4504e2
dec ebp
jo 0x450508
push ebx
out 0x85, al
mov al, byte [0x1eb6fe4a]
mov edi, 0x8966bbf9
or ah, byte [edi]
adc byte [edi + 0xc], 0x60
push 0x22
enter 0x41c1, 0xf
add eax, dword [ecx - 0x6ddf0096]
outsb dx, byte [esi]
adc al, 0x10
or ecx, dword [ebx]
dec ecx
dec edi
loope 0x45051e
neg dword [esi + 0x86583ff]
dec edx
std
dec ecx
call 0x15d03fdb
add ebp, dword [eax]
int 0x89
or dword [ebp + 8], ecx
int 0x4f
xor bl, ch
mov bl, 0x18
inc ebp
in al, dx
dec esp
mov cl, 0xac
mov ecx, dword [eax + 0xa008bbc]

Function at 0x458fc5
Capabilities:
Encode data using xor

Disassembly:
cmp dword [edx + 0x68], ecx
add dword [esi], edx
dec ecx
loopne 0x45902a
push esi
dec edx
invalid
pop ecx
mov dword [edi + 0x37], esi
mov dword [ebp + 0x53], 0x6efffff7
outsb dx, byte [esi]
in al, dx
add al, byte [eax]
jge 0x459082
jmp 0x459020
push ebp
cmpsd dword [esi], dword es:[edi]
mov eax, dword [0xf39c54]
xchg ebx, eax
sbb eax, 0x351674e6
inc esi
xor eax, 0xea96e4
invalid
Function at 0x46243d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.004591ee
lea edi, [eax + 0x9c]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x46242b
or dword [edi + 8], 0x104
jmp 0x4624ee
mov dword [edi], eax
add eax, 0x40
lea ebx, [edi + 4]
mov dword [ebx], eax
je 0x46244c
cmp byte [eax], 0
je 0x46244c
push ebx
push 0x16
push 0x471e40
call fcn.00461e78
add esp, 0xc
mov eax, dword [edi]
and dword [edi + 8], 0
test eax, eax
je 0x4624b1
cmp byte [eax], 0
je 0x4624b1
mov eax, dword [ebx]
test eax, eax
je 0x46246f
cmp byte [eax], 0
je 0x46246f
mov esi, edi
call fcn.00462362
jmp 0x462476
mov esi, edi
call fcn.004623c9
cmp dword [edi + 8], 0
jne 0x462504
push edi
push 0x40
push 0x471c38
call fcn.00461e78
add esp, 0xc
test eax, eax
je 0x4624fa
mov ebx, dword [ebx]
test ebx, ebx
je 0x4624a8
cmp byte [ebx], 0
je 0x4624a8
mov esi, edi
call fcn.00462362
jmp 0x4624fa
mov esi, edi
call fcn.004623c9
jmp 0x4624fa
mov ebx, dword [ebx]
test ebx, ebx
je 0x4624e7
cmp byte [ebx], 0
je 0x4624e7
push ebx
call fcn.00454460
sub eax, 3
neg eax
pop ecx
sbb eax, eax
push 1
inc eax
push 0x461fcf
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [edi + 8], 4
jne 0x4624fa
and dword [edi + 8], 0
jmp 0x4624fa
mov dword [edi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
cmp dword [edi + 8], 0
je 0x4625ef
mov esi, dword [ebp + 8]
mov eax, esi
sub eax, 0xffffff80
neg esi
sbb esi, esi
and esi, eax
call fcn.00461eda
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
je 0x4625ef
cmp esi, 0xfde8
je 0x4625ef
cmp esi, 0xfde9
je 0x4625ef
movzx eax, si
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4625ef
push 1
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4625ef
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x46257b
mov cx, word [edi + 0x18]
mov word [eax], cx
mov cx, word [edi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], si
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4625ea
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0x814
cmp word [eax], cx
jne 0x4625b2
push 0x471f14
push 0x40
push ebx
call fcn.00458934
add esp, 0xc
test eax, eax
je 0x4625c3
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00458ca3
push 0x40
push ebx
push 0x1001
push dword [edi + 0x18]
call esi
test eax, eax
je 0x4625ef
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [edi + 0x1c]
call esi
test eax, eax
je 0x4625ef
push 0xa
push 0x10
sub ebx, 0xffffff80
push ebx
push dword [ebp + 8]
call fcn.00454cf3
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4625f1
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46424f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x496d50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor esi, esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
call edi
mov ecx, eax
mov dword [ebp - 0xc], ecx
cmp ecx, esi
jne 0x464261
xor eax, eax
jmp 0x4642e7
jle 0x4642a8
push 0xffffffffffffffe0
xor edx, edx
pop eax
div ecx
cmp eax, 2
jb 0x4642a8
lea eax, [ecx + ecx + 8]
cmp eax, 0x400
ja 0x464290
call fcn.0045fad0
mov ebx, esp
cmp ebx, esi
je 0x46425a
mov dword [ebx], 0xcccc
add ebx, 8
jmp 0x4642aa
push eax
call int.00450419
pop ecx
cmp eax, esi
je 0x4642a4
mov dword [eax], 0xdddd
add eax, 8
mov ebx, eax
jmp 0x4642aa
xor ebx, ebx
cmp ebx, esi
je 0x46425a
push dword [ebp - 0xc]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x4642de
push esi
push esi
cmp dword [ebp + 0x18], esi
jne 0x4642c9
push esi
push esi
jmp 0x4642cf
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0xffffffffffffffff
push ebx
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push ebx
call fcn.00451b54
pop ecx
mov eax, esi
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044e488
leave
ret

Function at 0x4669dd
Capabilities:
Encode data using xor

Disassembly:
mov esp, dword [ecx + 0x59]
mov esp, esp
xor dword [esp + edx + 0x53], ebx
xchg ebx, eax
pop ebp
or al, 0xd6
pushal
and dword [eax], ecx
xor esp, ecx
das
jo 0x4669e7
dec eax
xchg edx, eax
clc
loope 0x466a3f
and ch, byte [edx + 0x16]
dec ecx
invalid
add bh, byte [0x175d4984]
pop ss
movsx edx, byte [edx]
and ch, bl
add ebp, dword [edx + 0x51]
pop ecx
mov ah, bh
das
dec edx
test edx, edi
jg 0x466a3a
mov ebp, dword [edi + 0x2680c66b]
mov eax, dword [0x82ae78d2]
cmp esi, dword [0x83eb0d7c]
xlatb
dec esp
xor byte [eax - 0x7f], cl
xor byte [ecx], bh
je 0x466a69
ret

Function at 0x468112
Capabilities:
Encode data using xor

Disassembly:
push ss
and edx, dword [ebp - 0x75]
or eax, dword [ebp + 0x5ced18ec]
push edi
xor ecx, dword [edx + 0x4c]
add ebx, edx
insd dword es:[edi], dx
push 0x40600875
invalid
Function at 0x401e50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x5c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
add esp, 0x54
ret

Function at 0x402000
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 8]
ret 8

Function at 0x402030
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
mov ecx, 0x3dcf55d3
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1a5622de
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402060
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x41800c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x50], 0x44
mov word [ebp - 0xe], ax
xorps xmm0, xmm0
mov eax, 3
movlpd qword [ebp - 0x4c], xmm0
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
movlpd qword [ebp - 0x44], xmm0
push eax
push 0
push 0
push 0x200
push 0
push 0
push 0
push ecx
push 0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x1e], xmm0
movlpd qword [ebp - 0x16], xmm0
mov dword [ebp - 0x24], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4020e9
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004049ab
mov esp, ebp
pop ebp
ret
Function at 0x4051f4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405233
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405233
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405233
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405233
cmp dword [ecx + 0x74], 0xe
jbe 0x405233
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x409dbc
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x41800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x409e07
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00409fd9
test al, al
jne 0x409e01
sub edx, 2
cmp edx, edi
jne 0x409de7
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x409e29
lea eax, [edi + 2]
cmp edx, eax
je 0x409e29
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00409d08
add esp, 0x10
jmp 0x409f23
push esi
lea ecx, [ebp - 0x255]
call fcn.00409fd9
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409e6c
push dword [ebp - 0x25c]
jmp 0x409e19
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x409ea9
cmp word [ebp - 0x226], 0
je 0x409eca
cmp word [ebp - 0x226], ax
jne 0x409ea9
cmp word [ebp - 0x224], 0
je 0x409eca
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00409d08
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x409f16
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x409e83
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x409efe
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x409f23
push 0x409b38
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040ca20
add esp, 0x10
jmp 0x409ef3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004049ab
leave
ret

Function at 0x40ad0c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412b44
push 0x412b3c
push str.FlsAlloc
push 0x1f
call fcn.0040ac47
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ad40
push dword [ebp + 8]
mov ecx, esi
call dword [0x41113c]
call esi
jmp 0x40ad46
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x40ad8a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412b54
push 0x412b4c
push str.FlsGetValue
push 0x21
call fcn.0040ac47
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40adc1
push dword [ebp + 8]
mov ecx, esi
call dword [0x41113c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40adc9
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412b5c
push 0x412b54
push str.FlsSetValue
push 0x22
call fcn.0040ac47
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ae03
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41113c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4106a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4106cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4106cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret