joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd21632
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
jmp 0xced6a5
pushal
not ebx
mov bx, di
mov ah, 0xa9
mov dword [esp + 4], ebp
jmp 0xd21864
push ebx
jmp 0xd216dc
setge ah
jmp 0xd21dbd
mov byte [eax], 0
jmp 0xd21896
push edi
jmp 0xd218b2
jmp 0xd21666
jbe 0xced6bd
mov ax, 0x910b
sub esp, 0xd
jmp 0xd2168c
lea esp, [esp + 4]
test ecx, ecx
pushfd
mov dword [esp], ebx
lea esp, [esp + 4]
jmp 0xd21650
lea esp, [esp + 0xc]
lea edi, reloc.mscoree.dll__CorExeMain
push eax
push word [esp]
jmp 0xd2169e
lea esp, [esp + 1]
xor eax, eax
mov edi, dword [esp]
lea edi, [edx*4]
jmp 0xd21676
mov byte [esp + 1], ch
lea esp, [esp + 2]
jmp 0xd217a7
lea esp, [esp + 0x14]
push dword [ebp + 0xc]
mov dx, 0x38f5
lea edx, [ecx + ebx]
jmp 0xd21705
mov dword [esp + 4], eax
sub esp, 0xc
lea esp, [esp + 2]
jmp 0xd216ac
mov eax, esi
call 0xd0a6f6
neg dl
sub esp, 0xa
jmp 0xd216c2
mov eax, esi
call fcn.00d0a729
lea ecx, reloc.mscoree.dll__CorExeMain
mov cx, 0xc7b3
rcl ch, 3
jmp 0xd21744
mov edx, eax
mov al, 0xb6
lea eax, [ebp*4]
lea eax, reloc.mscoree.dll__CorExeMain
jmp 0xd216ea
lea esp, [esp + 0x40]
pop ecx
mov dword [ebp - 8], eax
test edx, edx
jmp 0xd21728
jbe 0xced69e
lea edi, reloc.mscoree.dll__CorExeMain
mov cl, byte [esp]
inc ch
jmp 0xd21773
pop ecx
bswap ecx
pushal
pushal
jmp 0xd21718
pop cx
mov ch, 0xbc
lea ecx, [esi*4]
lea esp, [esp + 1]
sub ebx, eax
jmp 0xd21784
lea esi, reloc.mscoree.dll__CorExeMain
seto ch
mov eax, edi
sub esp, 0x17
jmp 0xd2174b
bswap ecx
mov dword [ebp - 4], edx
lea esp, [esp + 0x14]
jmp 0xced6d3
lea esp, [esp + 4]
rep stosd dword es:[edi], eax
jmp 0xced6bd
call int.00d0a713
rcl ecx, 0x1a
jmp 0xd217d4
push dword [ebx + edi]
mov edx, edi
setp al
mov eax, edi
jmp 0xd217b2
add dword [esi], eax
not cx
pop ecx
jmp 0xd21a17
lea ecx, [edx*4]
lea ecx, reloc.mscoree.dll__CorExeMain
jmp 0xd218d2
rdtsc
mov eax, dword [esp]
mov ecx, dword [ebp - 8]
lea eax, reloc.mscoree.dll__CorExeMain
jmp 0xd217c8
call fcn.00d0a72e
mov ah, dh
mov di, 0xe71b
xchg ah, bl
jmp 0xd21846
mov eax, dword [ebp + 8]
mov cx, 0x99cb
mov ch, dh
lea ecx, reloc.mscoree.dll__CorExeMain
jmp 0xd21809
lea esp, [esp + 8]
pop esi
mov ah, byte [esp]
not ax
jmp 0xd21883
mov edi, dword [esp]
xchg ah, bl
lea eax, [ecx + ebp]
push esp
mov ah, 0x30
jmp 0xd21830
popal
lea esi, [esi - 0xc]
mov edx, dword [esi]
pop esi
jmp 0xd2181f
mov bl, 0x1f
mov bh, 0xde
mov bh, byte [esp]
jmp 0xd218ac
mov dword [ebp - 4], reloc.mscoree.dll__CorExeMain
not ebx
lea eax, reloc.mscoree.dll__CorExeMain
mov bh, 0xbd
jmp 0xd2186d
inc eax
jmp 0xced758
pop ebx
jmp 0xced758
mov edi, ebp
lea edi, [edi - 4]
mov ecx, dword [edi]
pop edi
call fcn.00d219a5
push es
wait
or ebp, dword [esi - 0x63]
sub eax, 0xf592fc6c
add al, 0xb0
pop edx
leave
pop ecx
cmp bl, cl
jge 0xd218ba
pop ecx
jne 0xced6d3
je 0xced69e
jne 0xced716
pushal
pushfd
mov dword [esp + 5], eax
lea esp, [esp + 0x24]
jmp 0xd21951
leave
ret
add edi, 4
add esi, 4
mov ecx, dword [esp]
dec dword [ebp - 4]
jmp 0xd217df
bswap ecx
mov ax, word [esp]
neg eax
push dword [ebp + 0xc]
rdtsc
jmp 0xd217f9
Function at 0xda22dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg si, dx
sub esp, 0xe
pop word [esp + 6]
mov bp, word [esp + 7]
jmp 0xda22df
jmp 0xda22c7
pop dword [esp + 0x1a]
push dword [esp + 1]
bts edx, ebp
push dword [esp + 0x1c]
sbb edx, ecx
cmc
jmp 0xda2323
mov cx, word [esp + 0x2f]
mov edi, ebp
cmp ebx, ecx
and bl, dh
add esp, 8
jmp 0xda238b
neg ecx
dec ecx
rdtsc
stc
push dword [esp + 0x25]
sbb dh, 0x29
jmp 0xda230d
mov ch, 0xd3
sets bl
cmc
mov ecx, dword [esp]
clc
rcr si, 6
jmp 0xda2352
pop word [esp + 0x15]
bsr bx, sp
inc al
clc
sub esp, 0x12
lea esp, [esp + 0x45]
jmp 0xda2368

Function at 0xda49f9
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0xda4a30
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xda4a1a

Function at 0xda4a15
Capabilities:
Parse pe header

Disassembly:
call fcn.00da4013
call 0xda49e9
mov eax, dword [eax]
jmp 0xda4a7d
mov eax, dword [eax + 8]
push eax
jmp 0xda400e

Function at 0x408f18
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
nop
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x18]
and eax, 1
cmp eax, 0
je 0x408f46
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x50], eax
jmp 0x408f4e
mov eax, 0xa
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x48], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x408f7d
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.msvcrt.dll_strstr
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, 0
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jne 0x408fa3
mov eax, section..data
push eax
call sub.msvcrt.dll__strdup
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x408fcc
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
jbe 0x408fcc
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x408fcc
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.004048a2
leave
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x1000b5e0
Capabilities:
Compare security identifiers

Disassembly:
cmp dword [0x101056ec], esi
jne 0x1000b610
lea eax, [ebp - 0x50]
mov dword [ebx], esi
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000b61f
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
jne 0x1000b630
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000b637
push dword [ebp - 0x54]
lea ecx, [ebp - 0x4c]
call fcn.1000640a
mov esi, dword [ebp - 0x4c]
test al, al
je 0x1000b63e
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
je 0x1000b64f
push 0x44
pop edi
push edi
lea eax, [ebp - 0x48]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x5c], edi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0xb
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1000b656
xor ecx, ecx
mov dword [ebp - 0x58], ecx
test esi, esi
jne 0x1000b65d
jmp 0x1000b673
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1000670c
mov eax, dword [ebp - 0x4c]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1000671e
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x4c]
inc ecx
mov dword [ebp - 0x58], ecx
add eax, 8
jmp 0x1000b660
mov dword [ebx], edi
mov dword [0x101056ec], edi
mov eax, dword [ebx]
mov dword [0x101034ac], eax
test esi, esi
je 0x10006760
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
jmp 0x10006760
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x1000674b
push eax
mov dword [ebp - 0x50], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001550
mov esp, ebp
pop ebp
ret 4
xor esi, esi
jmp 0x1000673a
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x54], esi
push edi
test ebx, ebx
jne 0x10006629
push 0x15b3c8
jmp 0x1000b624
mov eax, dword [0x101034ac]
xor edi, edi
mov dword [ebx], eax
inc edi
jmp 0x1000673a
push 0x15b3c9
call fcn.1008ee44
mov edi, esi
jmp 0x1000673a
push 0x15b3ca
jmp 0x1000b624
push 0x15b3cb
jmp 0x1000b624
push 0x15b3cc
call fcn.1008ee44
xor edi, edi
jmp 0x1000672d
push 0x15b3cd
jmp 0x1000b643
push 0x15b3ce
jmp 0x1000b643
lea eax, [esi + 4]
xor edi, edi
mov dword [ebp - 0x4c], eax
inc edi
cmp ecx, dword [esi]
jb 0x100066ed
jmp 0x10006720
xor ecx, ecx
mov dword [0], 1
int 0x29
Function at 0x10011c7f
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x10011c8c
lea esi, [ecx - 0x90]
jmp 0x10011c8e
xor esi, esi
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
cmp dword [esi + 0x60], 0
je 0x10011cab
push 0
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x1001ebaa
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_SHGetFileInfoW]

Function at 0x10029b36
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x10029c57
mov edx, dword [ebp + 0x14]
xor eax, eax
push esi
mov esi, dword [ebp + 8]
inc eax
sub eax, esi
mov dword [ebp + 8], eax
push 2
pop eax
sub eax, esi
mov dword [ebp - 4], eax
lea eax, [edi + esi]
movzx eax, byte [eax]
shr eax, 2
movzx ecx, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [edx]
mov word [eax], cx
lea ecx, [edi + esi]
mov eax, dword [ebp + 8]
add dword [edx], 2
add eax, ecx
cmp eax, ebx
je 0x10029c23
mov al, byte [ecx]
and al, 3
shl al, 4
movzx ecx, al
movzx eax, byte [edi + esi + 1]
shr eax, 4
or ecx, eax
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [edx]
mov word [ecx], ax
lea ecx, [edi + esi]
mov eax, dword [ebp - 4]
add dword [edx], 2
add eax, ecx
cmp eax, ebx
mov al, byte [edi + esi + 1]
je 0x10029bff
and al, 0xf
shl al, 2
movzx ecx, al
movzx eax, byte [edi + esi + 2]
shr eax, 6
or ecx, eax
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [edx]
mov word [ecx], ax
add dword [edx], 2
movzx eax, byte [edi + esi + 2]
add edi, 3
mov ecx, dword [edx]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], ax
add dword [edx], 2
cmp edi, ebx
jae 0x10029c56
jmp 0x10029b60
mov ecx, dword [edx]
and al, 0xf
shl al, 2
movzx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], ax
add dword [edx], 2
cmp byte [ebp + 0x10], 0
mov eax, dword [edx]
je 0x10029c56
push 0x3d
pop ecx
jmp 0x10029c50
mov al, byte [edi + esi]
mov ecx, dword [edx]
and al, 3
shl al, 4
movzx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx], ax
add dword [edx], 2
cmp byte [ebp + 0x10], 0
mov eax, dword [edx]
je 0x10029c56
push 0x3d
pop ecx
mov word [eax], cx
add dword [edx], 2
mov eax, dword [edx]
mov word [eax], cx
add dword [edx], 2
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1003c2da
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x100a3460
call fcn.10001360
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push 0x14
mov dword [ebp - 4], ebx
call fcn.10002483
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1003c31c
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.1002a940
jmp 0x1003c31e
mov eax, ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.1002b709
push esi
mov dword [ebp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [esi + 0x18]
cmp dword [esi + 0x18], 1
mov byte [ebp - 4], 2
jne 0x1003c34b
cmp dword [esi + 0x1c], ebx
jne 0x1003c34b
mov ecx, dword [esi + 0x24]
call fcn.1001b5a6
push esi
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 0x1003ca7c
mov dword [ebp - 0x10], ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1003c37a
push 0x2e6b6831
call fcn.1003cf47
call fcn.100013a0
ret 0x14
Function at 0x1004c59e
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a5db5
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100b7bfc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0xc0]
call fcn.1002506a
lea ecx, [esi + 0x44]
call fcn.1002506a
and dword [ebp - 4], 0
lea ecx, [esi + 0x40]
call fcn.10006c2b
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], 1
call fcn.10006c2b
lea ecx, [esi + 0x38]
mov dword [ebp - 4], 2
call fcn.10006c2b
lea ecx, [esi + 0x34]
call fcn.1002506a
lea ecx, [esi + 0x30]
call fcn.1002506a
lea ecx, [esi + 0x2c]
call fcn.1002506a
lea ecx, [esi + 0x28]
call fcn.1002506a
lea ecx, [esi + 0x24]
call fcn.1002506a
lea ecx, [esi + 0x20]
mov dword [ebp - 4], 3
call fcn.10006c2b
lea ecx, [esi + 0x1c]
mov dword [ebp - 4], 4
call fcn.10006c2b
lea ecx, [esi + 0x18]
call fcn.1002506a
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 9
call fcn.10026969
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004c66d
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a5e06
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100b7bfc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x48]
mov dword [ebp - 4], 2
call fcn.10026969
lea ecx, [esi + 0x30]
call fcn.10026365
lea ecx, [esi + 0x1c]
call fcn.10026365
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 3
call fcn.10006c2b
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 8
call fcn.10026969
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004d1a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1004ceb8
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1004d1e1
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl

Function at 0x1004d1ee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1004cef3
sub al, 0xec
scasb al, byte es:[edi]
lodsd eax, dword [esi]
lea eax, [ebp - 0x40]
push eax
call fcn.1004cf03
push eax
push esi
push dword [ebp + 8]

Function at 0x1004d243
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.1004ceb8
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.1004cef3
mov esi, 0x8d7820a4
inc ebp
call 0x60ed2fe9
invalid
Function at 0x1004d73f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
invalid
invalid
Function at 0x1005810c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x414
mov eax, 0x100a0e05
call fcn.10002f71
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x420]
push 0x200
call fcn.10001b31
xor eax, eax
mov word [ebp - 0x40c], ax
and dword [ebp - 4], eax
lea eax, [ebp - 0x420]
push eax
push esi
call fcn.1002daaa
lea eax, [ebp - 0x420]
push eax
call fcn.10027c7b
mov edx, 0x104
cmp eax, edx
jbe 0x1005817e
mov eax, dword [ebp - 0x420]
xor ecx, ecx
mov byte [ebp - 0x418], 1
push edx
mov word [eax + 0x208], cx
lea ecx, [ebp - 0x420]
call fcn.1004161e
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea ecx, [ebp - 0x420]
setne bl
call fcn.100073a1
mov al, bl
call fcn.10003491
ret 4

Function at 0x10061301
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
not eax
and eax, 1
pop ebp
ret 4

Function at 0x100646ac
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp dword [ebp - 0x18], 0x800000
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.10001550
mov esp, ebp
pop ebp
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3cc556fd
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x70052019
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40110b
Capabilities:
Accept command line arguments

Disassembly:
push 0x5c
push 0x423c90
call fcn.00403e28
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x24], 0xbaadc0de
jne 0x40112f
push dword [ebp - 0x28]
call fcn.00401768
pop ecx
push 0x44
push 0
lea eax, [ebp - 0x6c]
push eax
call fcn.00401287
add esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
jne 0x401164
mov esi, 0x41d4a0
mov dword [ebp - 0x20], esi
mov al, 0x20
mov byte [ebp - 0x19], al
mov cl, byte [esi]
test cl, cl
je 0x401179
cmp cl, al
jg 0x401179
inc esi
mov dword [ebp - 0x20], esi
jmp 0x401169
mov cl, byte [esi]
cmp cl, al
jle 0x401193
cmp cl, 0x22
jne 0x40118d
movsx eax, al
xor eax, 0x20
mov byte [ebp - 0x19], al
inc esi
mov dword [ebp - 0x20], esi
jmp 0x401179
mov cl, byte [esi]
test cl, cl
je 0x4011a3
cmp cl, al
jg 0x4011a3
inc esi
mov dword [ebp - 0x20], esi
jmp 0x401193
call fcn.00401842
push ecx
push esi
call fcn.00401757
mov ecx, eax
call fcn.00415ca4
push eax
push 0
call fcn.00401772
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
push ecx
push dword [eax]
call fcn.00404550
pop ecx
pop ecx
ret

Function at 0x401842
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x62b00c], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x62b008], eax
pushaw
mov eax, 1
cpuid
shr edx, 0x1a
and edx, 1
mov dword [0x62b010], edx
popaw
call fcn.00404528
test eax, eax
je 0x4018ed
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edi, edi
mov ebx, 0x62b068
inc edi
push 0xfffffffffffffff6
mov dword [0x62b078], ebx
mov dword [0x62b084], edi
call esi
push 0xfffffffffffffff5
mov dword [0x62b088], eax
mov dword [0x62b098], ebx
mov dword [0x62b0a4], edi
call esi
push 0xfffffffffffffff4
mov dword [0x62b0a8], eax
mov dword [0x62b0b8], ebx
mov dword [0x62b0c4], edi
call esi
push 0x41d140
push 0x41d13c
mov dword [0x62b0c8], eax
call fcn.00401736
push 0x41d138
push 0x41d0e8
call fcn.00401736
add esp, 0x10
pop edi
pop esi
pop ebx
ret
push 0xffffffffffffffff
push 0x243
call fcn.00401772
int3
Function at 0x404200
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
imul esi, dword [esp + 0x14]
test esi, esi
jne 0x404216
xor eax, eax
jmp 0x4042e8
mov eax, dword [esp + 0x18]
xor ecx, ecx
and dword [esp + 4], ecx
test byte [eax + 0xc], 1
push ebx
push edi
mov edi, dword [eax + 0x10]
mov dword [esp + 0x1c], ecx
je 0x4042c7
xor edx, edx
xor eax, eax
test esi, esi
je 0x4042de
mov ebx, dword [esp + 0x14]
push ebp
lea ebp, [eax + 1]
cmp byte [ebx + ebp - 1], 0xa
jne 0x40429d
test eax, eax
je 0x404259
cmp byte [ebx + eax - 1], 0xd
je 0x40429d
cmp eax, edx
jbe 0x40427a
push 0
lea ecx, [esp + 0x14]
push ecx
sub eax, edx
push eax
lea eax, [edx + ebx]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
add dword [esp + 0x20], eax
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x41d298
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x10]
mov edx, ebp
mov dword [esp + 0x20], ecx
mov eax, ebp
cmp eax, esi
jb 0x404244
pop ebp
cmp eax, edx
jbe 0x4042de
push 0
lea ecx, [esp + 0x10]
push ecx
sub eax, edx
push eax
lea eax, [edx + ebx]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0xc]
jmp 0x4042de
push 0
lea eax, [esp + 0x20]
push eax
push esi
push dword [esp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
mov eax, ecx
xor edx, edx
div dword [esp + 0x18]
pop edi
pop ebx
pop esi
pop ecx
ret