joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f74c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x46f79d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x46f784
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x46f774
jmp 0x46f79d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x46f785
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47cc6c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.004185b0
mov esi, eax
xor eax, eax
push ebp
push 0x47cce6
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x47ccca
mov edx, ebx
mov eax, esi
call fcn.00418208
test byte [eax + 0x58], 1
je 0x47ccc4
push 0
mov edx, ebx
mov eax, esi
call fcn.00418208
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov edx, ebx
mov eax, esi
call fcn.004180f8
dec ebx
cmp ebx, 0xffffffff
jne 0x47cc98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cced
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.00418614
ret

Function at 0x485eb8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x485ee6
mov eax, ebx
call fcn.0048696c
cmp dword [ebx + 0x40], 0
je 0x485edf
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x485f57
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x485f49
cmp dword [ebx + 8], 0
je 0x485f08
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x485f1a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x485f49
cmp dword [ebx + 8], 0
je 0x485efb
cmp eax, 3
je 0x485f2d
dec eax
jne 0x485efb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x485efb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x485efb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x485f75
cmp dword [ebx + 0x14], 0xcc
je 0x485f75
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00485f80
pop ebx
ret

Function at 0x497d84
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov dword [ebp - 4], 0xff
mov ebx, 0x497dc0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x103]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x497db4
lea ebx, [ebp - 0x103]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x497de4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x497e74
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404148
mov eax, dword [ebp - 4]
call fcn.00404408
test al, al
jbe 0x497e5e
mov byte [ebp - 5], al
mov bl, 1
lea eax, [ebp - 0xc]
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.00404330
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404410
xor eax, eax
mov al, bl
mov edx, dword [edi]
movzx eax, byte [edx + eax - 1]
add esi, eax
imul esi, dword [ebp + 0x10]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 5]
jne 0x497e20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497e7b
lea eax, [ebp - 0xc]
call fcn.00404148
ret

Function at 0x497e84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004045f8
xor eax, eax
push ebp
push 0x497f7b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x23456789
push 0x34567890
lea eax, [ebp - 8]
push eax
mov ecx, 0x12345678
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00497de4
lea eax, [ebp - 0xc]
call fcn.00404148
lea eax, [ebp - 0x10]
call fcn.00404148
mov eax, dword [ebp - 8]
call fcn.00404408
mov esi, eax
test esi, esi
jle 0x497f1b
mov ebx, 1
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + ebx - 1]
shl eax, 8
xor eax, 7
or eax, 5
call fcn.00408920
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00404410
inc ebx
dec esi
jne 0x497ef3
xor ebx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00404408
mov ecx, 0xc
cdq
idiv ecx
mov esi, eax
lea eax, [ebp - 0x18]
push eax
mov edx, esi
imul edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404668
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00404410
inc ebx
cmp ebx, 0xc
jne 0x497f1d
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.0040419c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497f82
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040416c
ret

Function at 0x4990c0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407110
ret
Function at 0x49d748
Capabilities:
Inject apc

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 8]
call fcn.004045f8
xor eax, eax
push ebp
push 0x49d7ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.00404408
mov ebx, eax
inc ebx
push 4
push 0x1000
push ebx
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x49d7d6
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 8]
call fcn.00404660
push eax
push esi
push edi
call sub.kernel32.dll_WriteProcessMemory
cmp ebx, dword [ebp - 0x10]
jne 0x49d7d6
push esi
mov eax, dword [ebp - 4]
push eax
push 0x49d800
push 0x49d810
call sub.kernel32.dll_LoadLibraryA
push eax
call sub.kernel32.dll_GetProcAddress_1
push eax
call sub.kernel32.dll_QueueUserAPC
test eax, eax
je 0x49d7d6
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d7f3
lea eax, [ebp - 8]
call fcn.00404148
ret
Function at 0x49d984
Capabilities:
Create process on windows
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb90
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004045f8
mov eax, dword [ebp - 8]
call fcn.004045f8
mov eax, dword [ebp - 0xc]
call fcn.004045f8
xor eax, eax
push ebp
push 0x49db21
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x41a]
xor ecx, ecx
mov edx, 0x200
call fcn.00402d64
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.004041e0
mov eax, dword [ebp - 0x18]
call fcn.00408e5c
test al, al
je 0x49daf9
xor eax, eax
push ebp
push 0x49daf2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x219]
mov edx, dword [ebp - 4]
call fcn.00409304
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.004041e0
lea eax, [ebp - 0x41a]
mov edx, dword [ebp - 0x14]
call fcn.00409304
lea eax, [ebp - 0x45e]
xor ecx, ecx
mov edx, 0x44
call fcn.00402d64
mov dword [ebp - 0x45e], 0x44
push 0
lea eax, [ebp - 0x46e]
push eax
lea eax, [ebp - 0x45e]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x219]
push eax
push 0
push 0
call sub.kernel32.dll_CreateProcessInternalA
test eax, eax
jne 0x49da84
xor eax, eax
mov dword [ebp - 0x10], eax
call fcn.00403bac
jmp 0x49daf9
mov eax, dword [ebp - 0x466]
mov dword [0x4ae14c], eax
mov eax, dword [ebp - 0x46e]
mov dword [0x4ae150], eax
mov eax, dword [ebp - 0x46a]
push eax
call sub.kernel32.dll_SuspendThread
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x46a]
mov eax, dword [ebp - 0x46e]
call fcn.0049d748
mov eax, dword [ebp - 0x46a]
push eax
call sub.kernel32.dll_ResumeThread
push 0xffffffffffffffff
mov eax, dword [ebp - 0x46e]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x46e]
push eax
call sub.kernel32.dll_GetExitCodeProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49daf9
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49db28
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0040416c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040416c
ret

Function at 0x49db34
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.00409458
add esp, 0x108
pop ebx
ret

Function at 0x49db5c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00409458
add esp, 0x108
pop ebx
ret
Function at 0x49db88
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004045f8
xor eax, eax
push ebp
push 0x49dc00
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040419c
mov eax, dword [ebp - 4]
call fcn.00404408
mov esi, eax
test esi, esi
jle 0x49dbea
mov ebx, 1
mov eax, edi
call fcn.00404660
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x49dbcd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49dc07
lea eax, [ebp - 4]
call fcn.00404148
ret

Function at 0x49deb8
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49df68
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xc8
mov eax, ebx
call fcn.00404148
mov eax, dword [ebp - 8]
call fcn.00402738
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00407110
xor eax, eax
push ebp
push 0x49df4b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x49df35
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404340
lea edx, [ebp - 0xc]
mov eax, dword [ebx]
call fcn.004086b8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0040419c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49df52
mov eax, dword [ebp - 4]
call fcn.00402758
ret
Function at 0x49df74
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49e129
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
call fcn.0049deb8
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [0x4ae144], 1
je 0x49e0fe
xor edx, edx
mov eax, 2
call fcn.00482fd0
mov esi, eax
mov dword [ebp - 0x144], 0x128
lea edx, [ebp - 0x144]
mov eax, esi
call fcn.00482ff0
jmp 0x49e0f0
push 1
call sub.kernel32.dll_Sleep_1
cmp dword [0x4ae144], 1
je 0x49e0f8
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [ebp - 0x13c]
jne 0x49e026
lea edx, [ebp - 0x144]
mov eax, esi
call fcn.00483010
jmp 0x49e0f0
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004043b8
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0xc]
call fcn.00409120
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004043b8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0049ddc0
cmp bl, al
jne 0x49e0e3
test bl, bl
jne 0x49e0c4
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x13c]
call fcn.0049dc10
test al, al
je 0x49e0b5
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 0x18]
call fcn.004086b8
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x1c]
call fcn.00404554
je 0x49e0c4
lea edx, [ebp - 0x144]
mov eax, esi
call fcn.00483010
jmp 0x49e0f0
lea edx, [ebp - 0x144]
mov eax, esi
call fcn.00483010
jmp 0x49e0f0
push 0
mov eax, dword [ebp - 0x13c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push 0xa
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x144]
mov eax, esi
call fcn.00483010
test eax, eax
jne 0x49dff3
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e130
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.0040416c
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.0040416c
ret

Function at 0x49ea3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004045f8
xor eax, eax
push ebp
push 0x49eab4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040419c
mov eax, dword [ebp - 4]
call fcn.00404408
mov esi, eax
test esi, esi
jle 0x49ea9e
mov ebx, 1
mov eax, edi
call fcn.00404660
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x49ea81
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49eabb
lea eax, [ebp - 4]
call fcn.00404148
ret
Function at 0x49eac4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, eax
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x105]
call fcn.00409458
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49ee34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004045f8
xor eax, eax
push ebp
push 0x49eeac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040419c
mov eax, dword [ebp - 4]
call fcn.00404408
mov esi, eax
test esi, esi
jle 0x49ee96
mov ebx, 1
mov eax, edi
call fcn.00404660
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x49ee79
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49eeb3
lea eax, [ebp - 4]
call fcn.00404148
ret
Function at 0x4a1998
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a1b45
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 8
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 4]
mov edx, 0x4a1b5c
call fcn.00404554
je 0x4a1b2a
mov eax, dword [ebp - 4]
mov edx, 0x4a1b68
call fcn.00404554
jne 0x4a1a20
push 1
push 0
push 0
lea ecx, [ebp - 8]
mov edx, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 8]
call fcn.00404608
push eax
push 0x4a1b6c
mov eax, esi
call fcn.00440d54
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4a1b2a
mov eax, dword [ebp - 4]
mov edx, 0x4a1b7c
call fcn.00404554
jne 0x4a1a4b
lea ecx, [ebp - 0xc]
mov edx, 0xa
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.0042d184
jmp 0x4a1b2a
mov eax, dword [ebp - 4]
mov edx, 0x4a1b88
call fcn.00404554
jne 0x4a1aa6
lea ecx, [ebp - 0x10]
mov edx, 0xa
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0042d184
push 1
push 0
push 0
lea ecx, [ebp - 0x14]
mov edx, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00404608
push eax
push 0x4a1b6c
mov eax, esi
call fcn.00440d54
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4a1b2a
mov eax, dword [ebp - 4]
mov edx, 0x4a1b94
call fcn.00404554
jne 0x4a1b2a
push 4
lea ecx, [ebp - 0x18]
mov edx, 0xa
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00404608
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x4ac300]
mov eax, dword [eax]
call fcn.004598a4
mov eax, dword [ebp - 0x1c]
call fcn.00404608
mov ecx, eax
mov eax, dword [0x4ac300]
mov eax, dword [eax]
pop edx
call fcn.00459f20
cmp eax, 6
jne 0x4a1b2a
push 1
push 0
push 0
lea ecx, [ebp - 0x20]
mov edx, 9
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00404608
push eax
push 0x4a1b6c
mov eax, esi
call fcn.00440d54
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1b4c
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.0040416c
ret

Function at 0x4a1bc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004045f8
xor eax, eax
push ebp
push 0x4a1c3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040419c
mov eax, dword [ebp - 4]
call fcn.00404408
mov esi, eax
test esi, esi
jle 0x4a1c26
mov ebx, 1
mov eax, edi
call fcn.00404660
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4a1c09
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1c43
lea eax, [ebp - 4]
call fcn.00404148
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Get common file path
Write file on windows

Disassembly:
sub esp, 0x108
push esi
push edi
mov esi, 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x403278
push 0x4e9
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x403278
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test edi, edi
je 0x4010eb
cmp byte [edi], 0x22
jne 0x401052
mov al, byte [edi + 1]
test al, al
je 0x401052
mov al, byte [edi + esi]
inc esi
cmp al, 0x22
je 0x401052
cmp byte [edi + esi], 0
jne 0x401044
mov al, byte [edi + esi]
test al, al
je 0x4010eb
cmp al, 0x20
jne 0x40106a
mov al, byte [edi + esi + 1]
inc esi
cmp al, 0x20
je 0x401061
mov cl, byte [edi + esi]
cmp cl, 0x22
lea eax, [edi + esi]
je 0x401079
mov esi, eax
jmp 0x4010a1
inc esi
mov cl, byte [edi + esi]
lea edx, [edi + esi]
xor eax, eax
test cl, cl
je 0x401098
cmp cl, 0x22
je 0x401098
mov byte [esp + eax + 0xc], cl
mov cl, byte [edx + eax + 1]
inc eax
test cl, cl
jne 0x401086
mov byte [esp + eax + 0xc], 0
lea esi, [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4010eb
mov eax, dword [0x403270]
mov edx, dword [eax]
mov eax, dword [eax + 4]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
call dword [sym.imp.USER32.dll_GetActiveWindow]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret 0x10
Function at 0x5f1c6b
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0x5dbc6f

Function at 0x60e182
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x60eb7b
push dword [esp + 4]
jmp 0x60e8dc
call fcn.0060eba5
cmp dword [esp + 0x10], ebx
call fcn.0060eb31
lea esp, [esp + 8]
jle 0x60e1c9
jmp 0x60e156
pushal
push word [esp + 0xb]
push edx
jmp 0x60eafa
pushal
lea esp, [esp + 0x20]
mov esi, dword [esp + 0x1c]
jmp 0x60eb47
push dword [esp + 4]
lea esp, [esp + 0xc]
test ecx, ecx
pushal
jmp 0x60e943
jmp 0x60ecde
push esp
mov edx, dword [eax + ecx*4]
setae ah
neg ax
mov eax, dword [esp]
jmp 0x60ec3e
push edx
push dword [esp + 2]
jmp 0x60e0ea
lea esp, [esp + 4]
test ecx, ecx
push esp
push dword [esp]
jmp 0x60e907
lea esp, [esp + 0x24]
je 0x60e156
push edx
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x60e8a4
lea esp, [esp + 0xc]
cmp dword [esp + 0x10], ebx
push esp
mov word [esp], bx
pushal
jmp 0x60e8bb
lea esp, [esp + 8]
jle 0x60e13b
xchg bl, bh
mov bl, 0x54
mov bl, bh
jmp 0x60ed3a
mov edx, dword [esp + 0x1c]
xchg ch, al
sub esp, 6
mov ch, 0x90
neg cx
lea esp, [esp + 2]
jmp 0x60e96d
lea esp, [esp + 0x20]
jne 0x60e385
rdtsc
mov cl, byte [esp]
jmp 0x60e92b
mov ecx, dword [esp + 0x18]
call fcn.0060eacd
pop esp
retf 0x3f58
lea esp, [esp + 4]
movzx eax, word [edx + esi*2]
mov cl, ch
not cx
jmp 0x60e954
lea esp, [esp + 4]
mov dword [esp + 0x10], esi
jmp 0x60e116
lea esp, [esp + 0x11]
lea esp, [esp + 1]
lea esp, [esp + 0x14]
inc esi
push edx
jmp 0x60ead8
mov di, word [esp]
lea edi, [edi*4]
mov edi, dword [esp]
mov di, word [esp]
mov edi, dword [esp + 0x18]
jmp 0x60e060
pushal
mov word [esp + 0x1a], bx
lea esp, [esp + 0x20]
mov dword [esp + 0x38], 0
stc
jmp 0x60ed17
pop word [esp + 0xb]
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
mov dword [esp + 0x14], ebx
jmp 0x60e116
call fcn.005db6c0
call fcn.0060ebd6
lea esp, [esp + 0x24]
mov eax, dword [esp + 0x38]
pushal
mov byte [esp + 0xc], ch
jmp 0x60ecaa
lea esp, [esp + 4]
mov eax, dword [esp + 0x3c]
add edx, ebp
jmp 0x60ec02
pushal
push word [esp + 0x13]
lea esp, [esp + 2]
lea esp, [esp + 0x20]
jle 0x60e1df
jg 0x60ec82
mul dword gs:[edi + 2]
int1
dec edx
jge 0x60ec50
jle 0x60ec83
call 0x95668998
cld
movsx esi, byte [edi]
dec esi
pushal
cmp eax, ebx
lea esp, [esp + 0x20]
mov dword [esp + 0x38], eax
jmp 0x60ec4a
mov eax, dword [esp + 0x20]
inc esp
and al, 0x20
lea ebx, [ebx + edi]
stc
inc bl
inc si
jmp 0x60ec94
pop edi
jmp 0x60ecbc
push word [esp + 0xb]
push word [esp + 0x1b]
and al, 0x1b
lea esp, [esp + 0x24]
inc eax
cmc
jmp 0x60ec75
pop esi
mov ebp, 0x58cd9978
bsf bp, si
bswap ebx
call fcn.0060ecf3
pop ebp
rcl dword [ecx + 0x30], 0xc3
jg 0x60ecb2
inc edi
xlatb
mov dl, 0x41
invalid
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x38]
lea edx, [esi + 0xd5]
mov dh, bh
jmp 0x60e1e4
test ebx, ebx
push esp
lea esp, [esp + 4]
jl fcn.0060e1b1
jge 0x60e1df
and byte [ebx], 0xb3
salc
and eax, 0xfa64c6e2
popfd
insb byte es:[edi], dx
jmp 0x60ed48
mov ebx, 0x873fc6e4
lea ebx, [esi - 1]
pushal
mov word [esp + 8], sp
mov byte [esp + 0x15], ah
jmp 0x60ebc0