joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f40
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00401d70
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x403f76
jmp 0x403fae
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x403f73
cmp al, 9
je 0x403f73
cmp al, 0x22
jne 0x403f97
jmp 0x403ff6
cmp al, 9
je 0x403fa3
add ebx, 1
movzx eax, byte [ebx]
test al, 0xdf
jne 0x403f90
jmp 0x403fa3
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x403fa0
cmp al, 9
je 0x403fa0
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x403fbd
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401770
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
test al, al
je 0x404002
mov edx, ebx
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x22
jne 0x403ff2
cmp al, 0x22
jne 0x403fa3
lea ebx, [edx + 2]
jmp 0x403fa3
Function at 0x437d36
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x44f634]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00437ccb
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00423490
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x437d85
cmp dword [ebp - 0x1c], 5
jb 0x437d9d
jmp 0x437d99
cmp dword [ebp - 0x10], 1
jne 0x437d9d
cmp dword [ebp - 0x1c], 4
ja 0x437d99
jne 0x437d9d
cmp dword [ebp - 0x18], 0
jbe 0x437d9d
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x445044
call fcn.00437bbc
test eax, eax
jge 0x437dbe
mov byte [0x450e38], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004217a8
add ebp, 0x78
leave
ret

Function at 0x496263
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov esi, dword [eax + 0x20]
add esi, edi
xor ecx, ecx
push esi
mov esi, dword [esi]
add esi, edi
push eax
call fcn.004962aa
pop eax
pop esi
cmp ebx, edx
je 0x49628d
add esi, 4
inc ecx
cmp ecx, dword [eax + 0x18]
jb 0x496273
cmp ebx, edx
jne 0x4962a7
mov esi, dword [eax + 0x24]
add esi, edi
movzx ecx, word [esi + ecx*2]
mov esi, dword [eax + 0x1c]
add esi, edi
mov esi, dword [esi + ecx*4]
add esi, edi
xchg esi, eax
jmp 0x4962a9
xor eax, eax
ret
Function at 0xd44860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0xd74094]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00d5ab70
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0xd448af
cmp dword [ebp + 0xc], 0
jne 0xd448b9
jmp 0xd4498a
cmp dword [ebp + 0x10], 0
je 0xd4490e
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x218]
add eax, 2
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x218]
mov dx, word [ecx]
mov word [ebp - 0x21e], dx
add dword [ebp - 0x218], 2
cmp word [ebp - 0x21e], 0
jne 0xd448d7
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x21c]
sar eax, 1
mov dword [ebp - 0x224], eax
jne 0xd44912
jmp 0xd4498a
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [0xd6a128]
mov edx, dword [ebp + 0x10]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.00d5932d
add esp, 0xc
push 0xd71668
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00d58dd4
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0xd4495e
jmp 0xd4498a
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00d5964a
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.00d59082
add esp, 4
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00d58b58
mov esp, ebp
pop ebp
ret
Function at 0xd47d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0xd47d35
cmp dword [ebp + 0xc], 0xa
jae 0xd47d46
mov dword [ebp - 0x10], 0xffffffff
jmp 0xd47e1d
mov eax, dword [ebp + 0xc]
shl eax, 2
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 1
push ecx
call fcn.00d58bb6
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00d47c40
add esp, 0x14
test eax, eax
je 0xd47e16
push 0xd70834
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.00d58dd4
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0xd47dab
mov dword [ebp - 0x10], 0xfffffffe
jmp 0xd47e1d
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp - 4]
push edx
call fcn.00d58f89
add esp, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 8]
je 0xd47dd7
mov dword [ebp - 0x10], 0xfffffffe
jmp 0xd47e1d
call dword [0xd6a12c]
xor edx, edx
mov ecx, 0x1f4
div ecx
mov dword [ebp - 0x20], edx
call dword [0xd6a12c]
xor edx, edx
mov ecx, 0x3e8
div ecx
add edx, dword [ebp - 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x20]
push eax
push 1
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00d58f89
add esp, 0x10
jmp 0xd47e1d
mov dword [ebp - 0x10], 0xfffffffd
cmp dword [ebp - 0x14], 0
je 0xd47e2f
mov edx, dword [ebp - 0x14]
push edx
call fcn.00d59082
add esp, 4
cmp dword [ebp - 4], 0
je 0xd47e41
mov eax, dword [ebp - 4]
push eax
call fcn.00d58c80
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0xd4b530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0xd4b540
xor eax, eax
jmp 0xd4b6dd
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0xd4b69e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0xd6fb78]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0xd6fb78]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0xd6fb78]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0xd6fb78]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0xd6fb78]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0xd6fb78]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0xd6fb78]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0xd6fb78]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0xd4b549
cmp dword [ebp + 0x10], 0
je 0xd4b6d7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0xd6fb78]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0xd4b6a4
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x4181d8
Capabilities:
Encode data using xor

Disassembly:
and dword [ebx + 0x401270cb], esi
push edi
and byte [edx + ebp*4], dh
leave
js 0x4181da
nop
and byte [edx + 0xdabfcce], 0xd0
inc edx
xor byte [edi], al
jne 0x4181e1
dec byte [ebx - 0x2b]
lcall 0x9a70, 0xfa32b0c8
and dl, dh
dec esp
pushal
out 0xc6, al
xor byte [eax - 0x71d745ee], bh
mov dl, 0x24
in al, 0x9a
adc ebx, dword [ebx]
pop eax
mov esi, 0x3a6ad83f
push eax
or edi, esp
rcl ah, 1
jae 0x4181b0
test eax, 0x18be6617
aam 0xba
sub ch, byte [eax + 0x26bcd49a]
idiv byte [eax - 0x16]
add al, 0x2c
aaa
popal
inc esp
or al, 0x29
sal byte [edx], 0x8d
lea eax, [0x412202]
lea eax, [0x412202]
add ah, byte [edx]
inc ecx
add byte [edi + eax*8 + 0x2b042444], bl
mov cl, 0x40
add byte [ebx - 1], dl
pushfd
mov dword [esp + 4], 0x40b12b
push ebx
push dword [esp]
and al, 4
sub esi, dword [ecx - 0xacffc0]
xor al, 0x24
call fcn.004111f9
shl byte [edi], 0xb1
dec ebp
jnp 0x41820a
xchg esi, eax
jp 0x41817a
push es
dec esi
add eax, 0x92b6483c
enter 0xffffffffffffb274, 0xffffffffffffffc1
xor edi, edi
inc ecx
xor eax, 0xaa5d3b97
pop ebp
stosb byte es:[edi], al
sub al, 0xa3
sal dword [edi], 0x6d
add dl, byte [eax - 0x15ab55d4]
xor byte [edx - 0xf5fe550], ah
or dword [ecx - 0x6b], 0xe6b4ddc0
fnstenv [ebx]
fisttp word [esi]
mov edi, 0x310d8b9a
mov ebx, dword [ecx + 0x8623889]
adc byte [edx - 0x208ac560], bh
cmpsd dword [esi], dword es:[edi]
xor eax, 0x8bf957ed
leave
xchg ecx, eax
test dh, cl
pushal
nop
xchg dx, ax
leave
test byte fs:[esi - 0x846ca4d], 0xef
mov eax, ecx
add byte [esi], 0x70
aaa
cld
xor al, dh
loope 0x418244
test eax, 0x94984652
xchg esp, eax
sub al, byte [eax + 0x4e]
mov ah, 0x60
cli
push 0xffffffffffffffe4
mov ah, 0x8c
add bh, byte [eax - 0x3e]
xchg edx, eax
cmp byte [edx + 0x60ce7422], 0x4f
xor al, 0xf8
popfd
or byte [ebx + 0x21bff3c9], cl
ja 0x418260
dec ecx
aad 0x10
mov eax, dword [0x2ac86533]
sbb dword ss:[esi + 0x37b56d02], ebp
shl edx, cl
push ecx
outsd dx, dword [esi]
arpl bp, bp
aaa
movsd dword es:[edi], dword [esi]
sbb eax, 0x59c3adaf
sti
jmp 0x622d7be8

Function at 0x438c84
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x438a14
mov esi, dword [esp]
add esp, 4
inc ecx
and ebx, ecx
call fcn.00438cd5
sub ecx, 0x8c6b0a90
dec ecx
sub ebx, ecx
xor dword [eax], esi
inc ecx
add eax, 1
push ebx
pop ecx
dec ebx
cmp eax, edx
jne fcn.00438c84
sub ecx, 0xa631d6ba
add ecx, 0xa70b6c76
sub esp, 4
mov dword [esp], 0x4424e84e
pop ecx
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x403e59
pop dword [ebp - 0x4c]
mov eax, 0x9edd5dd5
sub eax, 0x9e9d1f7c
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x58760dd0
add dword [ebp - 0x5c], 0xf5dc377b
mov dword [ebp - 0x58], 0xf16089f4
add dword [ebp - 0x58], 0x40d2c251
mov dword [ebp - 0x54], 0x69f9512f
sub dword [ebp - 0x54], 0x1dad0d01
mov dword [ebp - 0x50], 0xb51483a3
add dword [ebp - 0x50], 0x4aeb7c5d
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x8f1d91b9
add eax, 0x7122eed3
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x45554033
sub dword [ebp - 0x5c], 0xd0e2d6dd
mov dword [ebp - 0x58], 0x5725fd34
sub dword [ebp - 0x58], 0x15b99bbf
mov dword [ebp - 0x54], 0x4da1d050
add dword [ebp - 0x54], 0x15cd9c1c
mov dword [ebp - 0x50], 0xc35284e3
sub dword [ebp - 0x50], 0xc35284e3
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x33bb1
push 0
call eax
mov ecx, 0xa2b6d19e
add ecx, 0x5d496a51
mov edi, eax
mov esi, 0xb5f6a3b4
add esi, 0x4a4a6c4c
add esi, dword [ebp - 0x4c]
mov ebx, 0xc4e88d59
sub ebx, 0x9613cf8b
add dword [ebp - 0x1c], esi
mov edx, dword [esi]
xor dword [ebp - 0x34], 0xb2648b36
sub edx, ebx
xor dword [ebp - 0x44], ecx
mov dword [edi], edx
sub dword [ebp - 8], 0x349c4ccd
add edi, 4
add esi, 4
loop 0x403f76
add eax, 0xe28f
mov ebx, eax
add eax, 0x325c6767
add eax, 0xcda3989e
mov ecx, 0x7745b46b
sub ecx, 0x7705b46b
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4a2c25
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x4b1800
call fcn.004a6f80
call fcn.004a6c51
movzx esi, ax
push 2
call fcn.004a6a51
pop ecx
mov eax, 0x5a4d
cmp word [sym.imp.advapi32.dll_RegCloseKey_1], ax
je 0x4a2adc
xor ebx, ebx
jmp 0x4a2b0f
mov eax, dword [0x40003c]
cmp dword [eax + sym.imp.advapi32.dll_RegCloseKey_1], 0x4550
jne 0x4a2ad8
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4a2ad8
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4a2b0f
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004a6473
or eax, eax
jne 0x4a2b23
push 0x1c
call fcn.004a2bfe
pop ecx
call fcn.004a5ed6
or eax, eax
jne 0x4a2b34
push 0x10
call fcn.004a2bfe
pop ecx
call fcn.004a6b38
and dword [ebp - 4], 0
call fcn.004a6488
or eax, eax
jns 0x4a2b4e
push 0x1b
call fcn.004a2bfe
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x5c1d30], eax
call fcn.004a6b78
mov dword [0x5bc4c8], eax
call fcn.004a6736
or eax, eax
jns 0x4a2b74
push 8
call fcn.004a5fb1
pop ecx
call fcn.004a696f
or eax, eax
jns 0x4a2b85
push 9
call fcn.004a5fb1
pop ecx
push 1
call fcn.004a5feb
pop ecx
or eax, eax
je 0x4a2b98
push eax
call fcn.004a5fb1
pop ecx
call fcn.004a6f28
push esi
push eax
push 0
push sym.imp.advapi32.dll_RegCloseKey_1
call main
push eax
pop esi
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x4a2bba
push esi
call fcn.004a6247
call fcn.004a5fdc
jmp 0x4a2bef
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.004a6fc5
ret
call fcn.004a6a9e
jmp 0x4a2aae
Function at 0x600650
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, word [esp]
btc ax, si
mov bh, byte [esp]
mov bx, cx
jmp 0x60066f

Function at 0x600666
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, ax
call fcn.00600650
aas
xchg dword [esp], ebp
xchg dx, ax
xchg ebx, eax
mov bl, byte [esp]
mov al, dh
mov dh, byte [esp]
jmp 0x6006c6
lea ebp, [ebp - 0x39]
bts ax, bx
xchg al, bh
call fcn.006006a3

Function at 0x600f13
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x600f39
mov bx, 0x4f9f
call fcn.00601056
add dword [edx + reloc.RASAPI32.dll_RasHangUpA], edx
adc dword [edi], reloc.RASAPI32.dll_RasHangUpA
or ah, byte [ebp - 0x899b82c]
ror dword [ebx - reloc.RASAPI32.dll_RasHangUpA], cl
add al, 0xeb
invalid
mov eax, dword [edx + ebp]
bsf edx, edi
js 0x600f15
mov bx, 0x4f9f
jmp 0x601414
mov dword [esi], eax
sub esp, 0xa
jbe 0x600fa6
push word [esp + 7]
jmp 0x60100d
push word [esp + 7]
rdtsc
jmp 0x600ff7
rdtsc
jmp 0x600ff7
jmp 0x600f4a

Function at 0x60f6dc
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x5f47b7
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x5f47d1
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x5f47c0
pop esi
jmp 0x5f47dc
ret 4
jmp 0x60f713
jmp 0x5f47aa

Function at 0x60fa44
Capabilities:
Check for trap flag exception

Disassembly:
lea ebx, [ebx + esi]
lea esp, [esp + 3]
jmp 0x60fa8d
lea ebx, [esi + esi]
xchg si, bx
mov bl, byte [esp]
lea esp, [esp + 1]
mov ebx, dword [esp + 1]
bswap esi
jmp 0x60fa6c

Function at 0x6e4adc
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.006e4063
mov byte [esp + 1], bl
lea esp, [esp + 2]
mov dword [esp + 0x58], edi
lea esp, [esp + 0x58]
jmp 0x6e4af8
push word [esp]
jmp 0x6e4ac6
mov eax, dword [eax]
jmp 0x6e4b56
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x6e4ae2
mov eax, dword [eax + 8]
push eax
jmp 0x6e405e
Function at 0x4017e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
clc
jae 0x4017eb
call 0x63d020
add byte [eax], al
mov eax, 0x23
cmp eax, 0x100
jl 0x4017f9
call 0x3dcb7c98
xor byte [eax], al
add byte [eax], al
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x49e400], eax
mov edx, 0xda4c2ca8
call fcn.00401160
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
call edx
stc
jb 0x401829
jmp 0xe8488307
push 8
call fcn.0040231a
push 4
mov esi, eax
call fcn.0040231a
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x401ac0
push 0
push 0
mov dword [eax], 0x4016f0
call fcn.004053af
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0x401889
cmp dword [edi], 0
je 0x401896
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [edi], eax
je 0x40189d
push 0
push dword [esi + 4]
push dword [esi]
call fcn.0040215e
add esp, 0xc
test eax, eax
jne 0x4018a4
pop edi
mov dword [esi], eax
mov dword [esi + 4], eax
pop esi
mov esp, ebp
pop ebp
ret
push 6
mov dword [edi], 0
call fcn.00401f00
push 1
call fcn.00401f00
push 5
call fcn.00401f00
push 2
call fcn.00401f00
int3

Function at 0x402c87
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402cc6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402cc6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402cc6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402cc6
cmp dword [ecx + 0x74], 0xe
jbe 0x402cc6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407855
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41226c
push 0x412264
push str.FlsAlloc
push 0x1e
call fcn.004076d6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407889
push dword [ebp + 8]
mov ecx, esi
call dword [0x410134]
call esi
jmp 0x40788f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4078d3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41227c
push 0x412274
push str.FlsGetValue
push 0x20
call fcn.004076d6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40790a
push dword [ebp + 8]
mov ecx, esi
call dword [0x410134]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40f160
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f18d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f18d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43b646
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
dec edi
call fcn.0043b673
mov edi, edi
xor dword [edx], ebx
mov edi, ecx
add edx, 1
and edi, ecx
mov edi, 0x985bd0bf
or ecx, edi
cmp edx, esi
jne fcn.0043b646
or ecx, ecx
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x408964
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
call fcn.0040898f
sub esp, 4
mov dword [esp], esi
pop esi
xor dword [ecx], edi
sub esi, 0x69cbaa8b
add ecx, 1
dec ebx
cmp ecx, edx
jne fcn.00408964
push 0x93d7933c
pop ebx
ret
Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a

Function at 0x4042ff
Capabilities:
Encode data using xor

Disassembly:
call fcn.004041df
xor ecx, ecx
mov cl, 0x8f
call 0x4042ff
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x404302
imul edi, dword [ebp + 0x5a], 0xffffffec
cli
stc
clc
test eax, 0x3403b54
enter 0x3b54, 0x40
add ecx, dword [ecx]
in eax, dx