joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440f25
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x440f5a
cmp edi, dword [esi + 0xc]
jge 0x440f5a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x440f5a
cmp edi, dword [eax + 8]
jge 0x440f5a
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x440f5c
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x441060
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x441094
jmp fcn.004361e6
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x441105
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x4411fe
cmp eax, dword [edi + 0xc]
jge 0x4411fe
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x441156
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x4411e7
cmp dword [ebp + 0xc], ebx
je 0x4411e7
jmp 0x441180
push 0x10
call fcn.00440df1
cmp eax, ebx
je 0x44116c
mov ecx, eax
call fcn.00441057
mov esi, eax
jmp 0x44116e
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x441197
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x4411a7
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x4411b9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004361e6
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.0042a920
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4411f9
cmp ecx, dword [esi + 8]
jge 0x4411f9
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x4411ff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4412bd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4412eb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x441309
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00441227
jmp 0x441309
mov eax, dword [esi + 0x14]
test eax, eax
je 0x441309
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00441227
test edi, edi
mov eax, edi
jne 0x4412f3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56b4b4]
test ecx, ecx
je 0x4413bc
jmp 0x4412bc
ret 8
Function at 0x1e806f7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
not esi
dec ebx
js 0x1e80539
mov dh, 0x4e
jmp 0x1e80523
not ebx
not esi
mov edx, dword [esp]
lea ebx, [eax + ebx]
call 0x1e80553
and al, 0xb2
and byte [edi - 0x4e], al
je 0x1e8056a
sub al, byte [ebp - 0x4a]
dec esi
mov dh, 0x4e
jmp 0x1e80523
mov byte [esp + 0x10], dh
call 0x1e80559
loope 0x1e805be
in al, 0x83
jle 0x1e80515
int1
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
test eax, 0xec83580e
adc ch, bl
inc esp
ror eax, cl
js 0x1e80587
sub esp, 0x12
jmp 0x1e8059d
jns 0x1e80bcd
mov ds, word [ecx]
mov eax, ebp
sbb ebp, dword [eax + 0x7a8fe87a]
into
invalid
jp 0x1e80554
invalid
xchg bx, dx
xchg word [esp + 2], ax
mov edx, 0x65d2a1c1
lea esp, [esp + 1]
jmp 0x1e804f6
lea esp, [esp + 2]
jmp 0x1e80823
jae 0x1e8053d
mov byte [esp + 0x10], dh
jmp 0x1e80541
neg esi
dec al
jle 0x1e805ef
fdivp st(6)
enter 0x2c7e, 0xffffffffffffff8d
cwde
xor eax, 0xebffff52
push cs
or byte [ebp + 0x5b9f6c05], dl
test byte [edi], dh
lea esp, [esp + 4]
jmp 0x1e805bd
lea ebx, reloc.KERNEL32.dll_TerminateProcess
jmp 0x1e805d9
rcl edx, 2
mov bx, word [esp]
not bl
call 0x1e80610
add byte [edx + esi + 0x6966a455], bl
mov byte [ebp - 0xadca68], cl
inc ecx
rol byte [edx], cl
lea ebx, reloc.KERNEL32.dll_TerminateProcess
rcl edx, 2
mov bx, word [esp]
not bl
jmp 0x1e80626
neg al
lea eax, [edx + ebx]
call 0x1e805d3
dec dx
bswap ebx
xchg dword [esp], esi
mov edx, 0x7ea00b1b
mov al, 0xaf
jmp 0x1e8063c
not esi
cmc
ja 0x1e8069b
sub esp, 0xc
pop word [esp + 2]
jmp 0x1e80654
sub ebx, 0xc80cbe61
lea esi, [esi + 0x3f]
lea eax, [esi*4]
jmp 0x1e8079c
jmp 0x1e80606
lea ebx, [ecx*4]
lea esp, [esp + 2]
call fcn.01e806c7
sbb byte [ebx + 0x52], bh
int 0x5c
scasd eax, dword es:[edi]
pop word [esp + 2]
lea ebx, [ecx*4]
lea esp, [esp + 2]
jmp 0x1e8070d
mov dh, dl
call 0x1e806f7
xchg esi, eax
xor al, 0xaa
int 0x3c
mov ebx, 0xd0b121a1
and esp, edx
loope 0x1e806f6
invalid
sub esp, 0xc
jmp 0x1e8066a
xlatb
jmp 0x1e8076f
add esi, dword [edi]
not ax
cmc
jle 0x1e8067f
mov dh, dl
jmp 0x1e80681
push dword [esp]
ret 4
bsr eax, ecx
bt edx, eax
btr dx, bp
xchg dword [esp], esi
bsf dx, dx
xchg bl, dl
jmp 0x1e8072c
lea esp, [esp + 0x14]
add esi, 0x4f1c49af
rdtsc
rcr dx, 7
je 0x1e80652
neg al
lea eax, [edx + ebx]
jmp 0x1e8060b
lea esp, [esp + 2]
jmp 0x1e80823

Function at 0x1e86448
Capabilities:
Encode data using xor

Disassembly:
call dword [eax + 0x4ea434b4]
jmp 0x1e86435
jmp 0x1e863f9
call 0x1e86448
inc edi
je 0x1e86481
insb byte es:[edi], dx
popal
jae 0x1e864b5
dec esi
popal
insd dword es:[edi], dx
inc ecx
add byte [eax - 0x18], dl
mov dh, 0xa9
invalid
jae 0x1e864ed
je 0x1e8651d
push edi
add cl, ch
invalid
push es
or al, byte [eax]
add cl, bl
pop ss
lahf
punpckhdq mm3, qword [ecx - 0x9e8d9e]
inc esp
and al, 8
aad 0xd7

Function at 0x1e89baa
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 1]
push word [esp + 6]
lea esp, [esp + 2]
jmp 0x1e89c5b
lea esp, [esp + 8]
push esi
lea esp, [esp + 4]
jmp 0x1e70046
Function at 0x1ebde57
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not dh
jmp 0x1ebde6f
xor ecx, ecx
not dl
mov dl, byte [esp]
jmp 0x1ebde63
xchg dword [esp], ebx
mov cx, bp
xchg word [esp], bx
jmp 0x1ebde41
lea esp, [esp + 4]
lea eax, [esi + 0x1a]
jmp 0x1e6ed2d
movzx edx, byte [eax + 1]
btc ebx, esi
mov bh, 0xf
mov bx, 0x6a7a
jmp 0x1ebdecb
movzx ebx, byte [eax]
cmc
shl edx, 8
clc
jmp 0x1ebdea0

Function at 0x1f4211b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 1], dh
mov dword [esp], eax
xchg edx, eax
add esp, 3
pop word [esp]
std
jmp 0x1f420ea
jmp 0x1f42100

Function at 0x1f4260b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
bsr dx, si
mov ax, di
mov dword [esp], ebp
push dword [esp + 4]
rcl dh, 6
jmp 0x1f42572
lea esp, [esp + 0x15]
mov dword [esp], esp
add esp, 3
mov ah, 0xf2
jmp 0x1f42589

Function at 0x1f426e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor al, ah
lea edx, [ecx - 0xc5]
lea esp, [esp + 7]
xchg bl, dh
lea esp, [esp + 0x20]
inc bh
jmp 0x1f4239f
seto bh
dec edx
mov byte [esp + 0x23], cl
pop dword [esp + 0x15]
setle ah
dec bh
jmp 0x1f423e3
mov eax, 0xbe12fbb1
mov dh, byte [esp + 0x21]
std
jmp 0x1f42471

Function at 0x1f42837
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 2], ah
xchg word [esp + 0x1f], bx
mov dword [esp + 8], esi
not dh
jmp 0x1f42839
jmp 0x1f42821
xchg edx, eax
rcr ax, 0xc
xchg byte [esp + 0x1a], bh
add esp, 0xb
mov bx, 0x6c4c
jmp 0x1f428b8
not bx
neg bl
bts dx, di
rdtsc
xchg byte [esp + 0xe], dh
lea eax, [esi*4]
jmp 0x1f4289b
mov bx, di
pop dword [esp]
lea esp, [esp + 1]
mov dword [esp + 0xd], eax
xchg bl, ah
lea esp, [esp + 3]
jmp 0x1f4285a
xchg dword [esp + 2], eax
mov eax, 0x828864e
pop word [esp + 3]
pop edx
lea eax, [eax + 0xcf]
jmp 0x1f428d1
lea edx, [esp + ecx]
mov dword [esp + 0xc], esp
push dword [esp + 0xf]
mov ax, word [esp + 2]
mov dx, word [esp + 3]
bswap ebx
jmp 0x1f42885
pop word [esp + 3]
rdtsc
push si
mov eax, edx
mov al, bl
mov dword [esp + 2], esp
jmp 0x1f4299c
mov dx, word [esp + 0x10]
lea ebx, reloc.KERNEL32.dll_TerminateProcess
Function at 0x1f42f0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1f42f60
pop dword [esp + 0xb]
mov ah, 0xc5
not ebx
pop word [esp]
std
pop dx
jmp 0x1f42f8f
pop ax
mov word [esp + 0x12], sp
cld
mov word [esp + 0xb], dx
pop word [esp + 0xc]
pop word [esp + 0xb]
jmp 0x1f42f4a
lea esp, [esp + 0xb]
pop edx
bswap eax
mov bh, 0x2b
sub esp, 0x1e
jmp 0x1f42fad
lea eax, reloc.KERNEL32.dll_TerminateProcess
lea ebx, [ebx + 0x80]
mov edx, 0x531854a1
std
mov dx, word [esp + 0x15]
sbb dx, 0x1df1
jmp 0x1f42f79
push word [esp + 5]
mov word [esp + 0x11], bp
call fcn.01f431ac
inc esi
outsd dx, dword [esi]
jb 0x1f4302d
popal
je 0x1f43010
jae 0x1f43039
popal
inc ecx
add dl, dl
outsd dx, dword [esi]
jne 0x1f43085
arpl word [ebp], sp
and edx, edx
out 0x87, al
pop esp
and al, 0x14
enter 0xffffffffffffeb58, 0x27
inc edi
je 0x1f43085
jb 0x1f430a6
arpl word [ebp + 0x73], sp
jae 0x1f43092
jae 0x1f430ae
push esi
jb 0x1f430b2
imul ebp, dword [edi + 0x6e], reloc.KERNEL32.dll_TerminateProcess
mov eax, 0x1e643bd
add byte [edi], cl
test byte [edi - 0x12], bl
invalid
imul edx, dword [esp + ebp*2 + 0x73], reloc.KERNEL32.dll_TerminateProcess
mov dword [esp + 0x19], ebx

Function at 0x1f45528
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
bsf edx, ebx
shl ebx, cl
mov byte [esp + 0xd], bl
inc edi
pushal
jmp 0x1f45549
sub esp, 0x1f
cld
jmp 0x1f45512
cpuid
mov bp, bx
cmc
not cx
setl ah
not ax
jmp 0x1f4555e
lea esp, [esp + 0x44]
neg di
btc di, ax
mov ah, byte [esp]
bswap edx
lea ebp, [ecx + edx]
jmp 0x1f4552e
sub esp, 8
mov dword [esp + 1], esi
xchg byte [esp + 3], bh
and bh, 0x50
setge ah
jmp 0x1f455a7
xchg word [esp + 4], di
mov dword [esp + 3], ecx
mov byte [esp + 4], dh
mov dword [esp + 3], ebp
lea edi, [esi*4]
lea esp, [esp + 5]
jmp 0x1f45588

Function at 0x1f456ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 8]
mov bh, byte [esp + 7]
mov bl, al
lea edx, [eax - 0x2c]
jmp 0x1f456aa
dec dh
lea esi, reloc.KERNEL32.dll_TerminateProcess
inc bx
setb dh
xchg dword [esp + 3], ebx
add esp, 2
jmp 0x1f45662
push word [esp + 2]
push dword [esp + 4]
xchg dword [esp + 6], esi
adc al, 0xec
rol edx, 0xe
jmp 0x1f456d6
mov ebp, 0xd11787f1
setle bh
not dx
mov ch, 0x1a
pop word [esp + 5]
xchg al, dl
jmp 0x1f4568f
mov bl, byte [esp + 8]
mov edx, edi
cpuid
xchg word [esp + 6], cx
xchg bl, al
jmp 0x1f4571e
push word [esp + 0xb]
mov dword [esp + 7], esp
not edx
add esp, 2
xchg cl, al
stc
jmp 0x1f456c0
xchg word [esp + 4], si
mov dword [esp + 1], eax
cpuid
jmp 0x1f45678
adc cl, 0x3d
xchg bx, cx
mov esi, 0xd377e91e
mov edi, esi
neg dx
xchg ch, bh
jmp 0x1f45732
xchg cx, di
std
mov al, byte [esp + 1]
xchg dword [esp + 4], ebp
bsr ebx, edx
mov di, dx
jmp 0x1f456ff
pushfd
mov ax, 0xa9ad
xchg ebx, edx
xchg dword [esp], ecx
mov eax, 0x7893de8d
jmp 0x1f457f8
lea edi, [ecx + edi]
pop bp
push word [esp + 0xa]
lea esp, [esp + 0x11]
cpuid
bswap ecx
jmp 0x1f4575a
setg ah
mov dword [esp + 0xb], ebx
push word [esp + 0xe]
setl cl
mov dl, 0x54
shr cl, cl
jmp 0x1f45770
lea esi, [edx*4]
mov al, byte [esp + 0xf]
pop cx
xchg ebp, esi
bswap edi
mov ebp, ecx
jmp 0x1f4578f
Function at 0x1f45ef7
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
xchg di, bp
clc
pop di
xchg bp, dx
rdtsc
jmp 0x1f45f05
mov cx, ax
xchg bh, bl
lea edx, [edx*4]
jmp 0x1f45ee1
mov ecx, esp
rdtsc
mov esi, 0x71dbb46d
push word [esp + 9]
mov al, dl
jmp 0x1f45f44
neg bx
lea esp, [esp + 3]
bswap esi
lea ebx, [edx*4]
jmp 0x1f45f5e
mov byte [esp], bl
xchg dword [esp + 7], edi
lea edi, [esi*4]
xchg byte [esp + 3], bh
xchg dword [esp + 5], edi
neg cl
jmp 0x1f45f2e
lea esp, [esp + 3]
mov ebp, 0xdc9d635c
neg dh
inc ah
xor ebp, 0xf1c072a0
lea ecx, [edi + ebp]
jmp 0x1f45fa7
mov edi, 0x50a737d2
add esp, 1
pop bp
dec dx
stc
xchg byte [esp], cl
jmp 0x1f45fd1
mov word [esp], si
lea eax, [esp + ebx]
mov bl, dh
pop di
xchg bh, ch
xchg word [esp + 1], di
jmp 0x1f45f91
mov si, word [esp]
mov bl, cl
push sp
xchg bx, cx
mov ebp, esp
push dx
jmp 0x1f45fe6
xchg byte [esp], dl
btr dx, cx
lea esp, [esp + 1]
xchg ebx, edx
xchg dx, ax
setg bh
jmp 0x1f45fbb
neg ax
bt ax, sp
lea esp, [esp + 1]
rdtsc
pushal
cld
jmp 0x1f46e48
add esp, 1
mov word [esp + 0x16], sp
neg bh
call fcn.01f465d9
xor dh, byte [edx + ebp + 0x2455bc4d]
mov eax, dword [reloc.KERNEL32.dll_TerminateProcess]
loop 0x1f46ed6
pop ss
loop 0x1f46e75
movsb byte es:[edi], byte [esi]
daa
mov bh, 0xd2
and esi, eax
rcr byte [eax - 0x32], cl
test eax, 0xb53cba58
cmp al, 0xb5
and eax, 0x2e1abf4c
cmpsb byte [esi], byte es:[edi]
xor al, 0x53
scasb al, byte es:[edi]
jp 0x1f46ede
fisttp dword [ebx + 0x2e]
fnsave dword [edx + esi*4]
cmp al, 0xd2
mov ch, 0x44
stosb byte es:[edi], al
test byte [ecx], cl
cdq
clc
or ebp, ebx
stosb byte es:[edi], al
cmp byte [edi - 0x56], bl
inc ecx
inc esp
iretd
test dword [reloc.KERNEL32.dll_TerminateProcess], edx
movsb byte es:[edi], byte ss:[esi]
ret

Function at 0x1f4634f
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.01f46055
push word [esp + 1]
pop word [esp + 1]
push ebx
pop word [esp + 2]
mov dword [esp], ebp
jmp 0x1f46550
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x1f46050
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x1f4641d
mov word [esp + 2], bx
lea esp, [esp + 2]
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], edi
jmp 0x1f464d2
Function at 0x40a94e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
pop esp
mov dword [esp + 0x88], 0x989c927a
mov dword [esp + 0x8c], 0x8397514c
xchg edi, eax
add edi, 0xffffff84
and al, 0x90
add byte [eax], al
add byte [edx - 0x386c6e6e], al
test byte [esp + edx*4], ah
add byte [eax], al
add byte [ecx - 0x3874756e], cl
test byte [eax + ebx*4], ah
add byte [eax], al
add byte [eax], al
dec edi
test dword [edi - 0x4e], ecx
mov dword [esp + 0x9c], 0xa2abafa4
mov dword [esp + 0xa0], 0x180a16b2
mov word [esp + 0xa4], 0x904
mov dword [esp + 0xa6], 0
add byte [eax], al
add bh, al
test byte [ecx + ebp*4], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, al
inc esp
and al, 8
add byte [eax], al
add byte [eax], al

Function at 0x40a990
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
pushfd
pop esp
mov dword [esp + 0x88], 0x989c927a
mov dword [esp + 0x8c], 0x8397514c
xchg edi, eax
add edi, 0xffffff84
and al, 0x90
add byte [eax], al
add byte [edx - 0x386c6e6e], al
test byte [esp + edx*4], ah
add byte [eax], al
add byte [ecx - 0x3874756e], cl
test byte [eax + ebx*4], ah
add byte [eax], al
add byte [eax], al
dec edi
test dword [edi - 0x4e], ecx
mov dword [esp + 0x9c], 0xa2abafa4
mov dword [esp + 0xa0], 0x180a16b2
mov word [esp + 0xa4], 0x904
mov dword [esp + 0xa6], 0
add byte [eax], al
add bh, al
test byte [ecx + ebp*4], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, al
inc esp
and al, 8
add byte [eax], al
add byte [eax], al
Function at 0x4108aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
in al, 0xf8
sub esp, 0xcf8
mov ecx, dword [0x441af4]
mov dword [esp + 0xd8], 0xb3ffcb96
mov dword [esp + 0xdc], 0
mov dword [esp + 0xe0], 0
mov byte [esp + 0xe4], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x30]
cmp eax, 0xc
ja 0x41094e
nop
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x30]
and al, 0x30
movzx edx, byte [esp + edx + 0xd8]
lea esi, [eax + 0x27e77a38]
out 0x27, eax
add al, 0xeb
js 0x41095f
jb 0x410900
mov edx, dword [0x441af0]
mov dword [esp + 0x2e8], 0x43a65251
add byte [eax], al
push ecx
push edx
cmpsb byte [esi], byte es:[edi]
inc ebx
cmp dword [edx], 0x2484c7de
in al, dx
add al, byte [eax]
add byte [esi - 0x3851aab0], ah
test byte [eax + esi*8], ah
add al, byte [eax]
add byte [esi - 0x3849bab4], bh
test byte [esp + esi*8], ah
add al, byte [eax]
add byte [ecx - 0x42], cl
mov ebp, 0x2484c74e
push cs
add al, 0xeb
js 0x410993
add byte [eax], al
inc edi
inc esp
add al, 0xb5
mov dword [esp + 0x2fc], 0x736bb741
mov dword [esp + 0x300], 0xc77c0906
add byte [eax], al
push es
or dword [edi + eax*8 - 0x39], edi
test byte [esp + eax], ah
add eax, dword [eax]
add ch, al
cmp dword [ebx], edx
pop edi
mov dword [esp + 0x308], 0
mov dword [esp + 0x268], 0
mov eax, dword [esp + 0x268]
Function at 0x43d583
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esi + 8]
mov ecx, dword [esi + 8]
movzx ecx, byte [esi + ecx + 0x68]
mov edx, eax
and edx, 0x13eeaa9c
xor eax, 0x93eeaa9c
lea eax, [eax + edx*2]
xor eax, ecx
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x28]
add al, 0xbc
mov ecx, dword [esi + 8]
mov byte [esi + ecx + 0x68], al
inc dword [esi + 8]
mov eax, dword [esi + 8]
cmp eax, 0xc
jb fcn.0043d583
mov eax, 0x439d00
add eax, dword [esi + 0x68]
mov dword [0x448adc], eax
mov eax, dword [0x446b38]
add byte [eax - 0x6f6f6f70], dl
nop
nop
jmp eax
Function at 0x403590
Capabilities:
Create pipe
Create process on windows
Get thread local storage value
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x180c
call fcn.004123f0
mov eax, dword [0x45b9f4]
mov ecx, dword [0x45b484]
push ebx
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x4036a7
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [0x45b9f4], 0x959
jne 0x403690
push 0
lea eax, [ebp - 0xc08]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [ebp - 0x1808]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
lea eax, [ebp - 0x1008]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp - 4]
push ecx
call fcn.004032d0
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x4035ce
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4055fb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44c168]
jne 0x405605
repz ret
jmp fcn.0040b4ac

Function at 0x40ba3e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a149
and dword [ebp - 4], 0
cmp dword [0x4529bc], 0
mov ebx, eax
jne 0x40baef
push 0x401bc0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bba0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401bb4
push edi
call esi
test eax, eax
je 0x40bba0
push eax
call fcn.0040a0d7
mov dword [esp], 0x401ba4
push edi
mov dword [0x4529bc], eax
call esi
push eax
call fcn.0040a0d7
mov dword [esp], 0x401b90
push edi
mov dword [0x4529c0], eax
call esi
push eax
call fcn.0040a0d7
mov dword [esp], 0x401b74
push edi
mov dword [0x4529c4], eax
call esi
push eax
call fcn.0040a0d7
pop ecx
mov dword [0x4529cc], eax
test eax, eax
je 0x40baef
push 0x401b5c
push edi
call esi
push eax
call fcn.0040a0d7
pop ecx
mov dword [0x4529c8], eax
mov eax, dword [0x4529c8]
cmp eax, ebx
je 0x40bb47
cmp dword [0x4529cc], ebx
je 0x40bb47
push eax
call fcn.0040a152
push dword [0x4529cc]
mov esi, eax
call fcn.0040a152
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bb47
test edi, edi
je 0x40bb47
call esi
test eax, eax
je 0x40bb3e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bb3e
test byte [ebp - 0xc], 1
jne 0x40bb47
or dword [ebp + 0x10], 0x200000
jmp 0x40bb80
mov eax, dword [0x4529c0]
cmp eax, ebx
je 0x40bb80
push eax
call fcn.0040a152
pop ecx
test eax, eax
je 0x40bb80
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bb80
mov eax, dword [0x4529c4]
cmp eax, ebx
je 0x40bb80
push eax
call fcn.0040a152
pop ecx
test eax, eax
je 0x40bb80
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4529bc]
call fcn.0040a152
pop ecx
test eax, eax
je 0x40bba0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bba2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001493
Capabilities:
Allocate or change rwx memory
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x10108933], 4
movzx eax, word [0x10108914]
push ebx
push esi
mov esi, dword [0x101a099c]
mov ebx, ecx
push edi
mov ecx, eax
je 0x100014c2
mov edx, eax
mov eax, dword [0x10108934]
add eax, 0x4f
add edx, eax
jmp 0x100014d9
mov edx, dword [0x10108930]
mov dword [ebp - 4], ecx
add edx, 0x3a
sub ecx, dword [0x10108934]
add edx, ecx
mov ecx, dword [ebp - 4]
lea eax, [ecx - 0x66]
movzx ecx, cx
sub ecx, ebx
mov byte [0x10108916], al
add ecx, 0x72
movzx eax, al
cmp byte [0x10108933], 4
je 0x100014fc
add eax, 0x32
add eax, ecx
jmp 0x10001500
sub eax, ecx
add eax, edx
movzx ecx, cx
mov dword [0x10108930], eax
mov dword [0x1010a7c4], esi
movzx esi, bx
lea edx, [ecx - 0x17]
mov eax, edx
lea edi, [ecx + 0x1d]
sub eax, esi
add edi, eax
push 0x721
sub edx, edi
push 0x101a09a8
sub edx, 0x72
push str.offer
mov word [0x10108914], dx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movzx ecx, byte [0x10108916]
mov al, byte [0x10108914]
sub ecx, 0x17
push 0x1010a7c8
push 0x40
add al, 0x32
mov dword [ebp - 4], ecx
push 0x509f
push dword [0x1010a7c4]
add al, cl
mov byte [0x10108916], al
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, byte [0x10108930]
mov ecx, dword [ebp - 4]
cmp eax, ecx
ja 0x10001595
mov eax, dword [0x10108934]
mov byte [0x1010892f], al
add eax, 0x6fc
add eax, ecx
mov dword [0x10108930], eax
imul eax, edi, 0xf5a
push 0x721
push 0x101098f0
add eax, 0x32
add eax, esi
add eax, ecx
mov word [0x10108914], ax
sub al, bl
add al, 0x1d
add byte [0x10108928], al
movzx eax, byte [0x10108916]
sub eax, ecx
add eax, 3
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, byte [0x10108930]
mov edx, eax
cmp ecx, ebx
ja 0x100015f4
mov ax, word [0x10108914]
lea edx, [ebx + 0x6fc]
mov byte [0x1010892f], al
movzx eax, ax
add edx, eax
push dword [0x1010a7c4]
movzx eax, word [0x10108914]
cmp edx, eax
jb 0x10001618
movzx eax, byte [0x10108927]
movzx ecx, bl
imul ecx, eax
mov byte [0x10108927], cl
movzx eax, byte [0x10108916]
mov esi, 0x6fc
mov ecx, dword [ebp - 4]
imul eax, eax, 0x5a
movzx edx, cx
add al, cl
add cl, 0x19
movzx eax, al
add cl, cl
add ax, dx
mov byte [0x10108916], cl
add ax, si
mov word [0x10108914], ax
sub al, bl
add al, 0x1d
add byte [0x10108928], al
ret