joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fef9a
Capabilities:
Check http status code

Disassembly:
mov eax, dword [eax + 0x10]
jmp 0x4dd61a
mov dword [0x44f8e0], eax
cmovno ax, bp
bswap ax
mov eax, dword [ebx]
jmp 0x48ebd8
mov ebx, dword [0x42e9c8]
mov byte [ebp - 1], 0
jmp 0x51c942
mov dword [0x44f8e4], eax
not ah
bswap eax
mov eax, dword [0x44f8e4]
jmp 0x54ed17
push ebp
mov ebp, esp
add esp, 0xfffffff8
jmp 0x517880
push ebx
mov bl, 0x1d
push esi
bswap si
push edi
movsx ebx, cx
movzx ebx, sp
mov esi, eax
jmp 0x4bed6f
push ebp
movsx ax, bl
movsx eax, cx
movzx ax, bl
push 0x501d2b
movsx eax, bx
push dword fs:[0]
movsx eax, bp
movzx ax, al
mov dword fs:[0], esp
sete ah
jmp 0x56814c
call fcn.004db4ce
shr eax, 2
mov dword [0x44f8ec], eax
xchg al, ah
mov eax, dword [0x44f8e0]
jmp loc.00419313
mov eax, dword [eax + 0x1c]
jmp 0x4b1dcb
mov eax, dword [ebx]
jmp 0x5628da

Function at 0x50015a
Capabilities:
Get disk information

Disassembly:
mov dword [esp], eax
jmp 0x4c4597
jmp 0x4efa92
mov eax, dword [esp]
add esp, 0x214
ret
lea esp, [esp - 0x214]
xor eax, eax
mov dword [esp], eax
stc
cmc
clc
cmp dword [0x44f9a8], 0
je 0x51c236
mov eax, dword [0x44f9a8]
jmp 0x46b195
mov edx, esp
movzx eax, sp
mov ecx, 4
mov ax, 0x4539
cbw
cwde
mov eax, 0x7d8
jmp loc.00417ba8

Function at 0x50b4b9
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x42eae8]
cmp ah, 0x80
mov eax, dword [eax]
cmp esp, 0xc726575
cmp eax, dword [esp]
jmp 0x51410a
push 4
lahf
movzx ecx, cx
cwde
lea ecx, [esp + 4]
xchg dl, dl
sete al
mov eax, dword [0x42e9c8]
mov eax, dword [eax]
mov dl, al
mov dl, 9
jmp 0x4ce3b2
mov eax, dword [0x42eae8]
test si, bx
stc
mov eax, dword [eax]
cmp eax, dword [esp]
jmp 0x497530
mov eax, dword [0x42eae8]
clc
stc
cmp dl, 0xc8
mov eax, dword [eax]
cmp sp, 0x2c11
cmp edx, eax
cmp eax, dword [esp]
jmp 0x4a7e45
jne 0x4e5e10
mov eax, dword [0x42eae8]
jmp 0x4ab5b3
je 0x48bdfd
dec eax
je 0x4bfa5f
dec eax
jmp 0x4944d5
je 0x4831f3
jmp 0x4e5e10
jne 0x4163df
cmp ebx, 1
jmp 0x51278b
jne 0x549c3a
cmp ebx, 0x27450020
jne 0x549c3a
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x42eb64]
mov dword [edx], eax
jmp 0x549c3a
mov edx, dword [esp]
cmc
jmp 0x41dac8
cmp ebx, 0x10
jmp 0x4e5de6
je 0x46aa5b
sub eax, 0x408
jmp 0x49326d
call fcn.00554845
jmp 0x4e5e10
jne 0x4e5e10
mov eax, dword [0x42eae8]
mov edx, dword [esp]
mov dword [eax], edx
movzx ax, dl
mov eax, dword [0x42eb64]
clc
cmp ebp, esp
cmc
sub edx, edx
mov dword [eax], edx
test si, bx
neg eax
bsf ax, bx
mov eax, dword [0x42e9c8]
jmp 0x51d5fc
je 0x4f0e23
mov eax, dword [0x42e9c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
cmp si, bx
clc
sub edx, edx
call fcn.0055cbca
pop edx
movzx ebx, ax
cmovg bx, di
mov bl, bl
pop ebx
ret
push ebx
sar bl, cl
shrd bx, si, 0xa2
push ecx
shr bl, 1
clc
cmc
mov ebx, ecx
mov dword [esp], edx
sub eax, 0x100
jmp 0x4ca1de
jne 0x4163df
mov eax, dword [0x42e9c8]
cmc
cmp si, 0x395c
jmp 0x41e292
mov eax, dword [eax]
cmp byte [eax + 0xe8], 0
jmp 0x4f0e08
dec ebx
jmp 0x48cef5
Function at 0x515be4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov ebx, edx
mov esi, ecx
mov esi, eax
jmp 0x520382
je 0x4b050e
call sub.kernel32.dll_GetTickCount_1
mov dword [esi], eax
mov eax, edi
lahf
mov eax, ebx
xchg esi, ebx
pop esi
mov bl, 0xda
mov ebx, ebp
bswap bx
pop ebx
ret
push ebx
mov bx, dx
jmp 0x46d90e
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [esi]
cmc
cmp ebx, eax
not al
setb al
mov ebx, eax
test bl, bl
jmp 0x4b04fe

Function at 0x51d62c
Capabilities:
Packed with generic packer

Disassembly:
pushal
jmp 0x492b52
jne 0x54c383
xor eax, eax
cmova dx, bx
xchg cx, dx
bswap ecx
pop edx
jmp 0x48d979
jmp loc.00427953
pop ecx
bswap ecx
pop ecx
jmp 0x551450
push dword [ebp - 4]
xchg ecx, ecx
movsx cx, bl
mov cx, 0x7fb2
mov ecx, dword [ebp - 8]
jmp loc.004275a6
call fcn.00403184
mov eax, dword [ebx + 0x140]
clc
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x150]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
jmp 0x47a19e
push ebp
mov ebp, esp
stc
test bx, si
add esp, 0xffffffec
cmp cx, 0x3fc5
clc
stc
push ebx
clc
seta bh
shld bx, bx, 0x86
push esi
ror bx, cl
push edi
dec si
sbb si, 0x180a
inc esi
mov esi, ecx
not bl
setnp bh
mov dword [ebp - 4], edx
sal dl, 0xfb
mov ebx, eax
xor edx, esp
bt edx, 0xfe
bts dx, di
mov byte [ebp - 0x11], 0
test ebp, 0x50af2569
btc edx, 0xf6
sub eax, eax
shr edx, 0xd2
btr edx, 0x74
test ax, bp
push ebp
mov dh, 0x68
test bx, sp
push 0x5172e5
adc dh, 0x9f
push dword fs:[eax]
mov dword fs:[eax], esp
adc dx, 0x2b00
mov eax, esi
xor ecx, ecx
mov dh, ch
mov edx, dword [ebp + 8]
jmp 0x4e4ecd
jne 0x474d81
xor eax, eax
pop edx
seta cl
movzx cx, dh
mov cl, bh
pop ecx
pop ecx
jmp 0x544f0e
mov dword fs:[eax], edx
jmp 0x486d05
cmp dword [ebp - 0xc], 0
jmp 0x51e21a
mov dword fs:[eax], edx
jmp fcn.0041e40b

Function at 0x524126
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x42e9c8]
mov cx, 0x68f2
movzx dx, bl
movsx edx, dx
mov eax, dword [eax]
not ch
cmovl cx, bx
mov ecx, esi
xchg dh, dh
movsx dx, al
cdq
mov edx, edi
jmp 0x4c99d3
je 0x53e361
mov eax, dword [0x42e9cc]
jmp 0x502b92
jmp 0x421af2
ret 8
cmp byte [eax], 0
jmp 0x50b124
cmp byte [0x44f8d7], 0
jmp 0x51e49a
je 0x421af2
mov eax, edi
mov dl, byte [eax]
test esi, esp
cmp si, dx
cmp dl, 4
jmp 0x53549b
jne 0x51e4b1
mov byte [0x44f8d7], 1
mov eax, 0xfffffffe
call fcn.004a6702
test esi, esi
jmp 0x47b6f4
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp esp, 0x7bbe7506
jmp 0x50a2a4
jne 0x565d4d
mov byte [eax], 3
jmp 0x4b951d
pop edi
cmovns esi, esp
pop esi
pop ebx
movsx ebp, sp
pop ebp
jmp 0x4ceb2b
cmp dl, 3
jmp 0x421ae9
Function at 0x52ca93
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movzx eax, bx
cwd
lea edx, [eax + eax*2]
setp al
movzx eax, bx
jmp 0x4f384a
mov byte [eax + edx], cl
jmp 0x49e337
mov dword fs:[eax], edx
cmova eax, edx
bswap eax
push 0x55cb24
movsx eax, bp
cmove ax, bx
lea eax, [ebp - 0x20]
jmp 0x4f0c00
xor eax, eax
pop edx
movzx ecx, cx
pop ecx
movzx cx, dl
jmp 0x4c42d9
mov eax, edi
call fcn.00404a6c
lea edx, [esi + esi*2]
mov cl, byte [ebx]
and cl, 0xf
and ecx, 0xff
jmp 0x4f89e7
dec eax
cmp edi, 0x4f8923c2
cmc
test eax, eax
jmp 0x4e2b93
pop ecx
jmp 0x47842a
jl 0x48d75e
inc eax
sal bl, cl
sar ebx, 0xbe
xchg bl, bh
mov dword [ebp - 0xc], eax
sub esi, esi
mov ebx, dword [ebp - 4]
bswap ax
mov ax, 0x28ff
mov eax, edi
jmp loc.004258ea
call fcn.00404580
ret
mov eax, edi
call fcn.00404afc
movzx eax, bx
jmp 0x51debc
mov cl, byte [ebp + ecx - 0x1c]
jmp 0x561544
mov byte [ebp - 0x21], 0xc9
mov eax, 0x4d71077d
not edx
movzx edx, cx
lea eax, [ebp - 0x30]
cdq
mov edx, 0xf
jmp 0x571236
dec eax
test eax, eax
jl 0x48d75e
inc eax
mov dword [ebp - 0xc], eax
sub ebx, ebp
bsf ax, di
sbb al, 0x82
sub esi, esi
mov ebx, dword [ebp - 4]
mov ax, bp
mov eax, 0x21e100d0
nop
mov eax, edi
call fcn.00404a6c
lea edx, [esi + esi*2]
test esi, edi
sub ecx, ecx
rcl cl, cl
add cl, 0xfd
xchg cl, cl
mov cl, byte [ebx]
jmp 0x553a96
mov cl, byte [ebp + ecx - 0x1c]
jmp 0x476dc8
push ebp
mov ebp, esp
stc
add esp, 0xffffffd0
test cx, bx
push ebx
push esi
cmp eax, 0x44b92671
cmp bp, di
push edi
sub ebx, ebx
sub edi, ebp
mov dword [ebp - 0x20], ebx
bts di, bp
mov byte [ebp - 5], cl
or di, 0x3eb
bsf edi, ecx
ror cl, 0x74
mov ebx, edx
btr dx, bp
mov dword [ebp - 4], eax
shr ecx, 0x67
mov edi, dword [ebp + 8]
and edx, edx
xor eax, eax
jmp 0x548b61
push ebp
push 0x548930
movsx edx, sp
push dword fs:[eax]
mov dword fs:[eax], esp
not dl
lea ecx, [ebp - 0x20]
bswap dx
lahf
movzx dx, bl
mov byte [ebp - 0x30], 0x9c
not dl
mov byte [ebp - 0x2f], 0x18
mov byte [ebp - 0x2e], 0x3e
cdq
mov byte [ebp - 0x2d], 0x50
mov ah, 0xfc
mov byte [ebp - 0x2c], 0x58
mov byte [ebp - 0x2b], 0x7d
lahf
mov byte [ebp - 0x2a], 0x77
movsx eax, cx
cbw
xchg dl, ah
mov byte [ebp - 0x29], 0x40
cwd
mov dl, al
mov byte [ebp - 0x28], 0x4f
rdtsc
mov byte [ebp - 0x27], 0x4e
mov byte [ebp - 0x26], 0x27
lahf
mov byte [ebp - 0x25], 0x23
setae dh
cwde
mov byte [ebp - 0x24], 0x27
movsx edx, bp
mov byte [ebp - 0x23], 0x2c
mov byte [ebp - 0x22], 0x29
jmp 0x500770
shr ecx, 4
jmp 0x5278ea
jne 0x461c83
movzx eax, bx
mov edx, eax
sal ax, 6
or eax, ecx
add edx, edx
nop
mov eax, edi
call fcn.00404afc
movzx eax, bx
jmp 0x4a7109
mov byte [eax + edx + 1], cl
mov ax, bx
cmovl eax, ecx
mov eax, edi
call fcn.00404a6c
lea edx, [esi + esi*2]
not cl
mov cl, byte [ebp - 5]
mov byte [eax + edx + 2], cl
jmp loc.00427c0c
call fcn.0056ce03
mov edx, dword [ebp - 0x20]
movsx eax, bx
lahf
xchg ah, ah
lea eax, [ebp - 0x1c]
call fcn.004082e8
cmp byte [ebp - 5], 0
jmp 0x555971
Function at 0x53daf9
Capabilities:
Packed with generic packer

Disassembly:
pushal
not ch
push 0
bswap cx
seto cl
push dword [ebp - 4]
bswap cx
push dword [ebp - 8]
jmp 0x485ec2
jne 0x417ea8
sub eax, eax
mov dx, 0x6146
movsx ecx, di
pop edx
setns ch
mov ecx, 0x1e8b08f7
pop ecx
pop ecx
jmp 0x540d70
cmp dword [ebp - 0x10], 0
jmp 0x459867
mov dword fs:[eax], esp
adc eax, esi
cwde
xadd eax, eax
mov eax, dword [ebx + 0x140]
cmp bp, 0x7d0e
clc
mov dword [ebp - 0xc], eax
btc eax, ecx
mov eax, dword [ebx + 0x158]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
jmp 0x4e2c1b
jne 0x47830b
xor eax, eax
setg cl
cmovb edx, edi
cwd
pop edx
pop ecx
pop ecx
jmp 0x515916
jmp loc.00545325
push ebp
jmp 0x5664ff
jmp loc.00545325
mov dword fs:[eax], edx
jmp 0x4ff157
push ebp
mov ebp, esp
cmp ah, 0xe8
lea esp, [esp - 0x18]
test sp, 0x4ffe
test di, sp
push ebx
push esi
shld esi, edx, 0x8c
shr bx, 0xd7
push edi
movzx ebx, bp
mov dword [ebp - 4], ecx
clc
sbb esi, esp
rcl esi, 0x46
mov dword [ebp - 8], edx
inc bl
shld esi, esp, 0x94
ror bl, 0xb0
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test cx, di
test cx, 0x7b3c
xor eax, eax
test ebp, edx
mov dword [ebp - 0x18], eax
stc
cmp edx, 0x4fe81eb9
cmp ch, bl
sub eax, eax
stc
mov dword [esi], eax
xor eax, eax
stc
cmc
mov dword [edi], eax
not eax
shr al, cl
mov eax, dword [ebp + 8]
jmp 0x55dd58
mov dword fs:[eax], edx
jmp 0x4e97f1
xor edx, edx
test di, sp
mov dword [eax], edx
cmp dl, dh
sub eax, eax
jmp 0x4f5417
push 0x533f6d
push dword fs:[eax]
test sp, si
jmp 0x4b64e5

Function at 0x53eb8d
Capabilities:
Enumerate threads
Resume thread

Disassembly:
lea eax, [esp + 4]
push eax
jmp fcn.004c7626
je 0x4153fe
mov edx, dword [esp + 0x10]
test sp, 0x48f8
cmp edx, dword [esp]
jne 0x4153fe
push eax
jmp 0x51482a
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmc
cmp ebp, 0xffffffff
jmp 0x50ead0
call sub.kernel32.dll_Thread32First
test eax, eax
jmp 0x55639a
push ebp
jmp 0x4985ac
push ebp
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
sub ah, 0x4b
mov eax, ebx
add esp, 0x20
jmp 0x52f44e
push ebp
lea esp, [esp - 0x20]
stc
mov dword [esp], eax
test bx, di
sub ebx, ebx
jmp 0x54740e
je 0x4e182f
mov dword [esp + 4], 0x1c
bswap eax
lea eax, [esp + 4]
push eax
jmp 0x4c1ef3
push 0
push 2
call sub.kernel32.dll_OpenThread
mov esi, eax
cmp cl, 0xab
stc
test edi, 0x181075b
test esi, esi
jmp 0x56546a
pop ebp
mov esi, eax
jmp 0x555776
cmp edi, eax
jmp 0x478802
push ebx
push esi
stc
push edi
jmp 0x4e3513
call sub.kernel32.dll_GetCurrentThreadId_1
mov edi, eax
jmp 0x56c8c5
pop edi
movzx bx, bh
pop esi
pop ebx
ret
je 0x4e1824
mov eax, dword [esp + 0xc]
jmp 0x53702d
je 0x4e182f
push esi
jmp loc.0041b10c
push 0
push 4
jmp 0x48d24e

Function at 0x561ea2
Capabilities:
Packed with generic packer

Disassembly:
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebp + 0x18]
add eax, 5
jmp 0x5176db
pushfd
btc ax, 0x94
push dword [ebp + 0x14]
sar ah, cl
lahf
sal ah, 0xec
push dword [ebp + 0x10]
rcr eax, 0x7b
bswap ax
jmp 0x45f56c
call fcn.004cc7e4
popfd
movsx bx, ah
popal
pop ebp
jmp loc.0042cf1f
push ebp
cmovb ebp, eax
mov ebp, esp
pushal
jmp 0x4def23
Function at 0x56d277
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, byte [ebp - 1]
cmovo edi, ecx
jmp 0x46ef47
test ebx, ebx
je 0x512c81
xor eax, eax
push ebp
btc esi, edx
adc esi, esi
sub si, bp
push 0x4238c2
btr esi, eax
sub si, bx
push dword fs:[eax]
mov dword fs:[eax], esp
shr ax, cl
sar ah, cl
lea esi, [ebx + 8]
cmc
mov eax, dword [esi]
mov eax, dword [eax]
cmp bx, 0x633
mov dword [0x44f8dc], eax
jmp 0x428ac6
call fcn.005410c1
mov ebx, eax
test ebx, ebx
jmp 0x4b9a37
call fcn.005410c1
mov ebx, eax
clc
cmp bp, bx
test ebx, ebx
jmp 0x542600
call fcn.00479569
sub ecx, ecx
mov edx, 0xce0e21e
jmp 0x42cd99
je 0x4ab57a
cmp al, 0x68
jne 0x53fdc8
mov eax, 0x417450
jmp 0x4aa453
je 0x45b16d
dec ebx
cmp ax, 0x2983
jmp 0x45b16d
je 0x40cf82
lea eax, [ebx + 3]
cmp esp, 0x71bc6340
cmc
test ebp, 0x4b4f4a6d
mov al, byte [eax]
cmp bp, si
cmp al, 0x8b
jmp 0x4ab56c
push 0
mov byte [ebp - 0x1c], 0xc2
mov byte [ebp - 0x1b], 4
bswap ecx
rdtsc
movsx eax, sp
mov byte [ebp - 0x1a], 0
movsx edx, ax
lahf
lea eax, [ebp - 0x1c]
mov ecx, ebx
setne dl
mov edx, 2
call fcn.005410c1
mov ebx, eax
test ebx, ebx
jmp 0x4ceee7
call fcn.00479569
xor ecx, ecx
movsx edx, bx
movzx edx, dx
mov edx, 0xce0e21e
jmp 0x556855
mov eax, 0x417450
jmp 0x5110ed
call fcn.00457e8c
mov byte [ebp - 1], al
jmp 0x40cf68
mov byte [ebp - 0x15], 0xdc
cwd
cwde
mov byte [ebp - 0x14], 0x50
movzx ax, dh
cdq
cbw
mov byte [ebp - 0x13], 0xff
not dl
mov byte [ebp - 0x12], 0x15
cbw
cmovbe eax, edi
bswap dx
lea eax, [ebp - 0x18]
cwd
mov edx, 6
jmp 0x46114e
call sub.kernel32.dll_GetCurrentProcessId
call fcn.004c7cfa
mov byte [0x42e910], 1
cdq
push 0
cbw
xchg dl, al
mov ch, 0xd1
mov ecx, 0x44f8dc
mov edx, 0x4171e0
cwde
mov eax, ebx
jmp 0x53792f
jne 0x45b16d
push 0x5000
rcr dx, cl
inc ecx
push 0
mov eax, dword [0x42e9c8]
rcr dx, cl
sub cl, 0xb1
mov eax, dword [eax]
cmc
mov ecx, dword [eax + 0x10]
and edx, ecx
bts eax, esp
add ecx, 0x2000
mov byte [ebp - 0x18], 4
not al
cwd
mov byte [ebp - 0x17], 0x89
movsx edx, sp
mov byte [ebp - 0x16], 0x45
jmp 0x53f092
call fcn.004fc52a
mov ebx, eax
mov dx, 0x60ba
push 0x50
mov dl, 0x34
jmp 0x4de7af
push ebp
cmp eax, 0x1b23491b
cbw
rdtsc
mov ebp, esp
and eax, 0x35b70fc8
add esp, 0xffffffe4
bt ecx, 0xc4
and dx, sp
push ebx
sal ah, 0x61
cmovne dx, sp
add al, 2
push esi
mov edx, esi
rcl ax, cl
bts dx, di
push edi
cdq
bswap ecx
adc ch, 0x4b
mov byte [ebp - 1], 0
setns dl
btc cx, 0xc0
push 0x5000
push 0
mov eax, dword [0x42e9c8]
bt edx, ebp
mov eax, dword [eax]
shl dx, cl
or ch, 0xc6
sub cx, 0x6b60
mov ecx, dword [eax + 0x10]
sal ah, cl
sub dl, al
cmc
add ecx, 0x2000
rdtsc
mov byte [ebp - 0x10], 0x56
cmovae edx, ecx
xchg al, dl
cbw
mov byte [ebp - 0xf], 0x8b
cbw
mov edx, ebp
mov byte [ebp - 0xe], 0xf1
bswap dx
mov byte [ebp - 0xd], 0x50
movzx eax, bp
bswap dx
mov byte [ebp - 0xc], 0x89
mov byte [ebp - 0xb], 6
bswap dx
cdq
mov byte [ebp - 0xa], 0xff
mov byte [ebp - 9], 0x15
movsx dx, cl
movsx eax, ax
not edx
lea eax, [ebp - 0x10]
mov edx, 7
jmp 0x48ca19
Function at 0x56fc11
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
cmp cx, sp
stc
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
jmp 0x4e1dbd
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
test ah, 0x52
cmp di, 0x5786
jmp loc.004257da
push ebp
mov ebp, esp
add esp, 0xffffffc8
cmp bx, 0x2704
push ebx
test ch, dl
test dl, 0xfc
cmp edi, ebx
push esi
jmp 0x47df57
Function at 0x10001030
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10001070
dec eax
jne 0x10001088
cmp dword [0x10030c5c], eax
jne 0x10001088
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push 0x100010a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10030c5c], 1
mov eax, 1
pop ebp
ret 0xc
cmp dword [0x10030c5c], 1
jne 0x10001088
call fcn.10001260
mov dword [0x10030c5c], 2
mov eax, 1
pop ebp
ret 0xc
Function at 0x10001b01
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000d018]
jne 0x10001b0b
repz ret
jmp fcn.10001edb

Function at 0x10008161
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000d018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10003248
and dword [ebp - 0x14], 0
cmp dword [0x10030c44], 0
mov dword [ebp - 0x18], eax
jne 0x10008214
push 0x1000c0d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100082bc
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000c0c8
push ebx
call edi
test eax, eax
je 0x100082bc
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x1000c0b8
push ebx
mov dword [0x10030c44], eax
call edi
push eax
call esi
push 0x1000c0a4
push ebx
mov dword [0x10030c48], eax
call edi
push eax
call esi
push 0x1000c088
push ebx
mov dword [0x10030c4c], eax
call edi
push eax
call esi
mov dword [0x10030c54], eax
test eax, eax
je 0x10008214
push 0x1000c070
push ebx
call edi
push eax
call esi
mov dword [0x10030c50], eax
mov eax, dword [0x10030c50]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000826d
cmp dword [0x10030c54], ecx
je 0x1000826d
push eax
call esi
push dword [0x10030c54]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000826d
test ebx, ebx
je 0x1000826d
call edi
test eax, eax
je 0x10008264
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10008264
test byte [ebp - 8], 1
jne 0x1000826d
or dword [ebp + 0x10], 0x200000
jmp 0x100082a0
mov eax, dword [0x10030c48]
cmp eax, dword [ebp - 0x18]
je 0x100082a0
push eax
call esi
test eax, eax
je 0x100082a0
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100082a0
mov eax, dword [0x10030c4c]
cmp eax, dword [ebp - 0x18]
je 0x100082a0
push eax
call esi
test eax, eax
je 0x100082a0
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10030c44]
call esi
test eax, eax
je 0x100082bc
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100082be
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001b01
leave
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x26e77afb
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..text_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x34276708
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x419610
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
jne 0x41967f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
push 0x4ce074
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test esi, esi
mov ebx, eax
mov dword [edi], esi
je 0x419655
push 0x4ce064
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 8], eax
pop esi
test ebx, ebx
pop ebx
je 0x41967f
mov ecx, dword [0x4d1ad4]
push 0x4d17c0
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [0x4d1ad4]
push edx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov dword [0x4d0fa8], eax
pop edi
pop ecx
ret

Function at 0x46207d
Capabilities:
Encode data using xor

Disassembly:
invalid
inc eax
das
sbb al, 0xc2
lds ebp, [ecx + eax*8 + 0x56ddc10e]
push esi
xchg edx, eax
mov edx, 0xe24d5073
or eax, 0x82e02c02
add ch, byte [eax]
or byte [eax], 0x8f
dec ebp
xchg byte [esi], al
push es
cmp al, 0x7c
invalid
mov eax, 0x5149a0d4
jne 0x462114
mov esi, 0xafe0a4c6
fdivr qword [ebp - 0x4a]
iretd

Function at 0x4c6fe1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4ce388
cmp edx, dword [eax]
je 0x4c7003
add eax, 8
inc ecx
cmp eax, 0x4ce418
jl 0x4c6ff4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4ce388]
jne 0x4c7131
mov eax, dword [0x4d3db8]
cmp eax, 1
je 0x4c710b
test eax, eax
jne 0x4c7034
cmp dword [0x4ce2b0], 1
je 0x4c710b
cmp edx, 0xfc
je 0x4c7131
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c706b
lea eax, [ebp - 0x1a4]
push 0x4cc6d0
push eax
call fcn.004c79c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c7e50
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c70ae
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c7e50
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cc6cc
push edi
call fcn.004c9d20
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4cc6b0
push eax
call fcn.004c79c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c79d0
lea eax, [ebp - 0xa0]
push 0x4cc6ac
push eax
call fcn.004c79d0
push dword [esi + 0x4ce38c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c79d0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cc684
push eax
call fcn.004c9c94
add esp, 0x2c
pop edi
jmp 0x4c7131
lea eax, [ebp + 8]
lea esi, [esi + 0x4ce38c]
push 0
push eax
push dword [esi]
call fcn.004c7e50
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x42e004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x74587fc0
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x401660dd
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
jmp 0x401219