joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6620a750
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
lea eax, [ebp + 0x14]
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x34], 0
jmp 0x6620a793
mov eax, dword [ebp - 0x34]
sub eax, 0xffffffff
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
add eax, 0xffffffff
mov dword [ebp + 0x10], eax
cmp dword [ebp - 0x34], 4
jae 0x6620a7be
cmp dword [ebp + 0x10], 0
jbe 0x6620a7be
mov eax, dword [ebp - 8]
sub eax, 0xfffffff8
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
mov esi, dword [ecx - 8]
mov dword [ebp + edx*8 - 0x30], esi
mov ecx, dword [ecx - 4]
mov dword [ebp + edx*8 - 0x2c], ecx
jmp 0x6620a781
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff8
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x10]
and edx, 1
je 0x6620a7e1
mov eax, dword [ebp + 0x10]
sub eax, 0xffffffff
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], 0
mov dword [ebp - 4], esp
mov eax, dword [ebp + 0x10]
and esp, 0xfffffff0
test eax, eax
je 0x6620a807
mov edi, dword [ebp - 0xc]
lea edi, [edi + eax*8 - 8]
push dword [edi + 4]
push dword [edi]
add edi, 0xfffffff8
dec eax
jne 0x6620a7fc
lea ecx, [ebp - 0x18]
mov eax, 4
push dword [ecx + 4]
push dword [ecx]
add ecx, 0xfffffff8
dec eax
jne 0x6620a80f
lea edx, [ebp + 8]
push 0x33
xor ecx, ecx
xor edx, edx
call fcn.6620a828

Function at 0x6620ae10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov bl, byte [eax]
cmp bl, 0xd8
push esi
je 0x6620ae41
cmp bl, 0xd7
je 0x6620ae41
lea ecx, [eax + 1]
mov esi, dword [esp + 0x14]
test esi, esi
jbe 0x6620ae69
mov eax, dword [esp + 0x10]
sub ecx, eax
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
sub esi, 1
jne 0x6620ae33
pop esi
pop ebx
ret
mov esi, dword [esp + 0x10]
inc eax
push esi
push eax
call fcn.6620af20
cmp bl, 0xd8
jne 0x6620ae69
mov ecx, dword [esp + 0x14]
xor eax, eax
or ecx, ecx
jbe 0x6620ae69
lea esp, [esp]
xor byte [eax + esi], 0xf0
inc eax
cmp eax, ecx
jb 0x6620ae60
pop esi
pop ebx
ret
Function at 0x6620b1ea
Capabilities:
Accept command line arguments

Disassembly:
mov ebp, ebp
push edi
mov edi, esp
mov eax, dword [edi + 0xc]
cmp eax, 1
push esi
push ebp
jne 0x6620b275
push eax
call fcn.6620dc2d
test eax, eax
pop ecx
jne 0x6620b20b
xor eax, eax
jmp 0x6620b319
call fcn.6620d332
or eax, eax
jne 0x6620b21b
call fcn.6620dc5d
jmp 0x6620b204
call fcn.6620dbe1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x6621f9b4], eax
call fcn.66201000
mov dword [0x6621de20], eax
call fcn.6620d93f
test eax, eax
jge 0x6620b245
call fcn.6620cfde
jmp 0x6620b214
call fcn.66201000
or eax, eax
jl 0x6620b26e
call fcn.66201000
test eax, eax
jl 0x6620b26e
push 0
call fcn.6620d71b
pop ecx
or eax, eax
jne 0x6620b26e
inc dword [0x6621de1c]
jmp 0x6620b316
call fcn.6620db93
jmp 0x6620b23e
xor ebp, ebp
cmp eax, ebp
jne 0x6620b2ac
cmp dword [0x6621de1c], ebp
jle 0x6620b204
dec dword [0x6621de1c]
cmp dword [0x6621de84], ebp
jne 0x6620b296
call fcn.6620d8e2
cmp dword [edi + 0x10], ebp
jne 0x6620b316
call fcn.6620db93
call fcn.6620cfde
call fcn.6620dc5d
jmp 0x6620b316
cmp eax, 2
jne 0x6620b30a
call fcn.6620cfaa
push 0x214
push 1
call fcn.6620d592
mov esi, eax
cmp esi, ebp
pop ecx
pop ecx
je 0x6620b204
push esi
push dword [0x6621cd00]
push dword [0x6621de4c]
call fcn.6620cf2f
pop ecx
call eax
or eax, eax
je 0x6620b2fe
push ebp
push esi
call fcn.6620d01b
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x6620b316
push esi
call fcn.6620d4bf
pop ecx
jmp 0x6620b204
cmp eax, 3
jne 0x6620b316
push ebp
call fcn.6620d2c4
pop ecx
xor eax, eax
inc eax
pop ebp
pop esi
pop edi
ret 0xc
Function at 0x6620cc5f
Capabilities:
Terminate process

Disassembly:
push ebp
mov eax, dword [0x6621cd88]
mov ebp, esp
add esp, 0xfffffcd8
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x328], 0
lea eax, [ebp - 0x324]
mov edi, edi
push ebx
push 0x4c
push 0
push eax
call fcn.6620b860
lea eax, [ebp - 0x328]
sub esp, 0xfffffff4
mov dword [ebp - 0x2d8], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
lea ecx, [ebp + 4]
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x2d0], 0x10001
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x20c], ecx
mov ecx, dword [ecx - 4]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x328], 0xc0000417
mov dword [ebp - 0x324], 1
mov dword [ebp - 0x31c], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x2d8]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
or eax, eax
jne 0x6620cd68
test ebx, ebx
jne 0x6620cd68
push 2
call fcn.6621186b
pop ecx
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.6620ed9b
leave
ret

Function at 0x6620cd87
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x6621de40]
call fcn.6620cf2f
pop ebp
test eax, eax
je 0x6620cd9f
pop edx
jmp eax
push 2
call fcn.6621186b
pop ecx
pop ebp
jmp fcn.6620cc5f
Function at 0x6620d332
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, str.KERNEL32.DLL
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
or eax, eax
jne 0x6620d34d
push esi
call fcn.6620d62c
pop ecx
mov esi, eax
or esi, esi
je 0x6620d4b5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FlsAlloc
push esi
call edi
push str.FlsGetValue
push esi
mov dword [0x6621de44], eax
call edi
push str.FlsSetValue
push esi
mov dword [0x6621de48], eax
call edi
push str.FlsFree
push esi
mov dword [0x6621de4c], eax
call edi
cmp dword [0x6621de44], 0
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x6621de50], eax
je 0x6620d3b6
cmp dword [0x6621de48], 0
je 0x6620d3b6
cmp dword [0x6621de4c], 0
je 0x6620d3b6
test eax, eax
jne 0x6620d3da
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x6621de48], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x6621de44], 0x6620cfa1
mov dword [0x6621de4c], esi
mov dword [0x6621de50], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x6621cd04], eax
je 0x6620d4ba
push dword [0x6621de48]
push eax
call esi
test eax, eax
je 0x6620d4ba
call fcn.6620d8f1
push dword [0x6621de44]
call fcn.6620ceb4
push dword [0x6621de48]
mov dword [0x6621de44], eax
call fcn.6620ceb4
push dword [0x6621de4c]
mov dword [0x6621de48], eax
call fcn.6620ceb4
push dword [0x6621de50]
mov dword [0x6621de4c], eax
call fcn.6620ceb4
add esp, 0x10
mov dword [0x6621de50], eax
call fcn.66211873
or eax, eax
je 0x6620d4b5
push fcn.6620d195
push dword [0x6621de44]
call fcn.6620cf2f
pop ecx
call eax
mov dword [0x6621cd00], eax
cmp eax, 0xffffffff
je 0x6620d4b5
push 0x214
push 1
call fcn.6620d592
pop ecx
mov esi, eax
pop ecx
or esi, esi
je 0x6620d4b5
push esi
push dword [0x6621cd00]
push dword [0x6621de4c]
call fcn.6620cf2f
pop ecx
call eax
test eax, eax
je 0x6620d4b5
push 0
push esi
call fcn.6620d01b
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x6620d4bc
call fcn.6620cfde
xor eax, eax
pop edi
pop esi
ret

Function at 0x6620ed9b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6621cd88]
jne 0x6620eda5
repz ret
jmp fcn.66212fb7
Function at 0x6621281f
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ebx, dword [edi*8 + 0x6621d660]
je 0x66212845
inc edi
mov dword [ebp - 4], edi
cmp edi, 0x17
jb 0x66212833
cmp edi, 0x17
jae 0x662129c5
push 3
call fcn.66214f81
pop ecx
cmp eax, 1
je 0x66212993
push 3
call fcn.66214f81
pop ecx
test eax, eax
jne 0x66212878
cmp dword [0x6621de2c], 1
je 0x66212993
cmp ebx, 0xfc
je 0x662129c5
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov edi, 0x6621e0c0
push edi
call fcn.66211769
sub esp, 0xfffffff4
test eax, eax
je 0x662128ae
push esi
push esi
push esi
push esi
push esi
call fcn.6620cc5f
sub esp, 0xffffffec
mov esi, 0x6621e0d9
push 0x104
push esi
push 0
mov byte [0x6621e1dd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or eax, eax
jne 0x662128f2
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.66211769
sub esp, 0xfffffff4
or eax, eax
je 0x662128f2
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.6620cc5f
sub esp, 0xffffffec
push esi
call fcn.662117e0
pop ecx
inc eax
cmp eax, 0x3c
jbe 0x66212937
push esi
call fcn.662117e0
mov ecx, 0x6621e3d4
push 3
sub esi, 0x3b
add eax, esi
push 0x66218bfc
sub ecx, eax
push ecx
push eax
call fcn.66214be6
sub esp, 0xffffffec
test eax, eax
je 0x66212937
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.6620cc5f
sub esp, 0xffffffec
jmp 0x66212939
xor esi, esi
push 0x66218bf8
push ebx
push edi
call fcn.66214b2c
sub esp, 0xfffffff4
test eax, eax
je 0x66212959
push esi
push esi
push esi
push esi
push esi
call fcn.6620cc5f
sub esp, 0xffffffec
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x6621d664]
push ebx
push edi
call fcn.66214b2c
sub esp, 0xfffffff4
or eax, eax
je 0x6621297e
push esi
push esi
push esi
push esi
push esi
call fcn.6620cc5f
sub esp, 0xffffffec
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push edi
call fcn.66214e18
sub esp, 0xfffffff4
jmp 0x662129c5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, eax
cmp ebx, esi
je 0x662129c5
cmp ebx, 0xffffffff
je 0x662129c5
push 0
lea esi, [edi*8 + 0x6621d664]
lea eax, [ebp - 8]
push eax
push dword [esi]
call fcn.662117e0
pop ecx
push eax
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x66212a30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edi, edi
mov ecx, dword [ebp + 8]
mov edx, 0x5a4d
cmp word [ecx], dx
je 0x66212a46
pop ebp
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x66212a42
xor ecx, ecx
mov edx, 0x10b
cmp word [eax + 0x18], dx
pop ebp
sete cl
mov eax, ecx
ret
Function at 0x66212a70
Capabilities:
Enumerate pe sections

Disassembly:
mov esi, esi
push edi
mov ecx, esp
mov eax, dword [ecx + 8]
mov edi, dword [eax + 0x3c]
add edi, eax
xor edx, edx
movzx eax, word [edi + 0x14]
lea eax, [eax + edi + 0x18]
push ebx
push ebp
movzx ebx, word [edi + 6]
push esi
test ebx, ebx
jbe 0x66212aad
mov ebp, dword [ecx + 0xc]
mov edi, dword [eax + 0xc]
cmp ebp, edi
jb 0x66212aa5
mov esi, dword [eax + 8]
add esi, edi
cmp ebp, esi
jb 0x66212aaf
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x66212a95
xor eax, eax
pop esi
pop ebp
pop ebx
pop edi
ret

Function at 0x66212fb7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x6621e508], eax
mov dword [0x6621e504], ecx
mov edi, edi
mov dword [0x6621e500], edx
mov dword [0x6621e4fc], ebx
mov dword [0x6621e4f8], esi
mov dword [0x6621e4f4], edi
mov word [0x6621e520], ss
mov word [0x6621e514], cs
mov word [0x6621e4f0], ds
mov word [0x6621e4ec], es
mov word [0x6621e4e8], fs
mov word [0x6621e4e4], gs
pushfd
pop dword [0x6621e518]
mov eax, dword [ebp]
mov dword [0x6621e50c], eax
mov eax, dword [ebp + 4]
mov dword [0x6621e510], eax
lea eax, [ebp + 8]
mov dword [0x6621e51c], eax
mov edi, dword [ebp - 0x320]
mov dword [0x6621e458], 0x10001
mov eax, dword [0x6621e510]
mov dword [0x6621e40c], eax
mov dword [0x6621e400], 0xc0000409
mov dword [0x6621e404], 1
mov eax, dword [0x6621cd88]
mov dword [ebp - 0x328], eax
mov eax, dword [0x6621cd8c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x6621e450], eax
push 1
call fcn.6621186b
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x66218c34
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x6621e450], 0
jne 0x662130a9
push 1
call fcn.6621186b
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x66214e18
Capabilities:
Link many functions at runtime

Disassembly:
mov ebx, ebx
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push edi
push ebx
call fcn.6620cf26
and dword [ebp - 4], 0
cmp dword [0x6621e778], 0
mov esi, eax
jne 0x66214ec9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x66214f7a
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call ebx
or eax, eax
je 0x66214f7a
push eax
call fcn.6620ceb4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x6621e778], eax
call ebx
push eax
call fcn.6620ceb4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6621e77c], eax
call ebx
push eax
call fcn.6620ceb4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x6621e780], eax
call ebx
push eax
call fcn.6620ceb4
pop ecx
mov dword [0x6621e788], eax
test eax, eax
je 0x66214ec9
push str.GetProcessWindowStation
push edi
call ebx
push eax
call fcn.6620ceb4
pop ecx
mov dword [0x6621e784], eax
mov eax, dword [0x6621e784]
cmp eax, esi
je 0x66214f21
cmp dword [0x6621e788], esi
je 0x66214f21
push eax
call fcn.6620cf2f
mov ebx, eax
push dword [0x6621e788]
call fcn.6620cf2f
or ebx, ebx
pop ecx
pop ecx
mov edi, eax
je 0x66214f21
or edi, edi
je 0x66214f21
call ebx
test eax, eax
je 0x66214f18
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x14]
push 0xc
push ecx
push 1
push eax
call edi
test eax, eax
je 0x66214f18
test byte [ebp - 0xc], 1
jne 0x66214f21
or dword [ebp + 0x10], 0x200000
jmp 0x66214f5a
mov eax, dword [0x6621e77c]
cmp eax, esi
je 0x66214f5a
push eax
call fcn.6620cf2f
pop ecx
test eax, eax
je 0x66214f5a
call eax
or eax, eax
mov dword [ebp - 4], eax
je 0x66214f5a
mov eax, dword [0x6621e780]
cmp eax, esi
je 0x66214f5a
push eax
call fcn.6620cf2f
or eax, eax
pop ecx
je 0x66214f5a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6621e778]
call fcn.6620cf2f
pop ecx
or eax, eax
je 0x66214f7a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x66214f7c
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x41b140
Capabilities:
Access the windows event log

Disassembly:
mov eax, dword [0x4286bc]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push edi
mov ebx, 0x1519a5
mov edi, 0x8e46a7b8
jmp 0x41b160
mov dword [0x428324], edi
cmp eax, 0x3dc
jne 0x41b17d
push 0x4234f4
push 0
push 0
call esi
mov eax, dword [0x4286bc]
dec ebx
jne 0x41b160
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
xor esi, esi
or ebx, 0xffffffff
jmp 0x41b190
cmp eax, 0x997
jne 0x41b1a2
push 0
push 0
call edi
mov eax, dword [0x4286bc]
cmp esi, 0x845f8b
jne 0x41b1b9
mov eax, dword [0x426950]
add eax, 0xa231
mov dword [0x4286bc], eax
cmp eax, 0x141
jne 0x41b1d0
mov dword [0x427ef8], 0xec58acac
mov dword [0x427efc], ebx
inc esi
cmp esi, 0x12cca12
jl 0x41b190
call fcn.0041ade0
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
mov ecx, 0x50aa506a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x6ed31bd1
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1000c004
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1000dec0
call fcn.1000c190
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1000f98c
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1000bda7
cmp eax, esi
jne 0x1000bd9a
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1000bdaa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000bd81
xor esi, esi
inc esi
mov eax, dword [0x1000f988]
cmp eax, esi
jne 0x1000bdbd
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x1000bdec
mov eax, dword [0x1000f988]
test eax, eax
jne 0x1000bde6
mov dword [0x1000f988], esi
push 0x100012ac
push 0x100012a0
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x1000bdec
jmp 0x1000bf14
mov dword [0x1000f644], esi
mov eax, dword [0x1000f988]
cmp eax, esi
jne 0x1000be10
push 0x1000129c
push 0x1000128c
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x1000f988], 2
test ebx, ebx
jne 0x1000be1c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1000f998], 0
je 0x1000be40
push 0x1000f998
call fcn.1000c500
pop ecx
test eax, eax
je 0x1000be40
push 0
push 2
push 0
call dword [0x1000f998]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1000be9c
test al, al
je 0x1000be5a
cmp dword [ebp - 0x1c], 0
jne 0x1000be9c
mov al, byte [esi]
test al, al
je 0x1000be6a
cmp al, 0x20
ja 0x1000be6a
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1000be5a
test byte [ebp - 0x3c], 1
je 0x1000be76
movzx eax, word [ebp - 0x38]
jmp 0x1000be79
push 0xa
pop eax
push eax
push esi
push 0
push 0x10000000
call main
mov dword [0x1000f640], eax
cmp dword [0x1000f634], 0
jne 0x1000bef0
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x1000beab
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x1000bebe
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1000be47
cmp dword [0x1000f644], 0
jne 0x1000beff
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1000f640]
jmp 0x1000bf20
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.1000c1d5
ret
call fcn.1009d000
jmp 0x1000bd47

Function at 0x1000c020
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000f15c]
jne 0x1000c02a
repz ret
jmp fcn.1000c685
Function at 0x1f2dcc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.001f3717
xor edi, edi
mov dword [0x221e5c], esi
lea eax, [ebp - 4]
mov dword [0x221e64], edi
push eax
push edi
push esi
push 0x1f3195
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, eax
mov dword [0x221e60], edx
test edx, edx
je 0x1f2e2c
cmp dword [0x221e98], 2
je 0x1f2e1d
call fcn.001f8e64
mov edx, dword [0x221e60]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x221e60]
mov eax, dword [0x221e64]
mov dword [0x221ffc], edi
test eax, eax
je 0x1f2e6e
cmp eax, 1
je 0x1f2e62
cmp eax, 2
je 0x1f2e5e
cmp eax, 3
je 0x1f2e5a
cmp eax, 0x67
jle 0x1f2e54
cmp eax, 0x6b
jle 0x1f2ed2
push eax
push 0x14
push edi
jmp 0x1f2eca
push 0x12
jmp 0x1f2e64
push 0x13
jmp 0x1f2e64
push 0x11
push edi
call fcn.001fa586
pop ecx
pop ecx
jmp 0x1f2ed2
mov ecx, edi
mov dword [ebp + 8], ecx
cmp dword [0x222000], ecx
jne 0x1f2ed2
test edx, edx
je 0x1f2e99
lea eax, [ebp + 8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [ebp + 8]
test eax, eax
je 0x1f2e99
test ecx, ecx
jne 0x1f2e99
xor eax, eax
jmp 0x1f2ed7
mov edx, 0x80070000
mov eax, ecx
and eax, edx
cmp eax, edx
je 0x1f2eab
push ecx
push 0x21
jmp 0x1f2e57
movzx eax, cx
cmp eax, 0xe
jne 0x1f2ebc
cmp dword [0x221e9c], 0xffffffff
je 0x1f2ed2
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
push 0x22
push 1
call fcn.001fa586
add esp, 0xc
mov eax, 0x80004005
pop edi
pop esi
leave
ret 4