joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f9c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100312b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10045018]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x10045024]
cmp eax, 0xffffffff
jne 0x1002f9f9
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x1002fa06
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x1002fa6d
jmp 0x1002fa3c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x1002faaa
test edi, edi
jne 0x1002fab0
push 0x1002f560
push 0x10048284
call fcn.1002f1c0
mov eax, dword [0x10045024]
add esp, 8
cmp eax, 0xffffffff
je 0x1002fa6d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x1002fa96
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1002fa96
mov eax, dword [ebp]
push 0
mov ecx, ebp
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x1002fae8
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x1002fad9
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
push 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x1002fab0
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov esi, dword [ebx]
mov dword [esp + 0x18], eax
cmp esi, ebx
je 0x1002fa30
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x1002fb47
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x1002fb2c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x1002fb47
jmp 0x1002fb20
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x1002fb20
jmp 0x1002fb47
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x1002fb45
cmp esi, dword [eax + 8]
jne 0x1002fb45
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x1002fb35
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x1002fb5b
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x1002fb5b
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
push eax
mov ecx, ebp
call fcn.1000f790
cmp esi, ebx
jne 0x1002fb00
mov ebp, dword [esp + 0x14]
jmp 0x1002fa30
Function at 0x1002fb80
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x18]
push eax
push 4
push edx
push 0x1002fbf0
push 0
push 0
call dword [sym.imp.MSVCR110.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x1002fbaa
pop esi
xor al, al
pop ebx
ret
mov ecx, dword [esi]
push edi
add ecx, 4
mov eax, 1
lock xadd dword [ecx], eax
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x1002fbce
cmp eax, 0xffffffff
je 0x1002fbce
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x401370
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x407008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x66c], ebx
call fcn.00401180
mov eax, ebx
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4013a0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
sub eax, edx
sar eax, 1
cmp word [ebx + eax*2 - 2], 0x5c
je 0x4013e1
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4013c2
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jae 0x4013e1
push 0x404284
push ebx
call esi
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x404288
lea eax, [ebp - 0x418]
push eax
call esi
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x670], eax
cmp eax, 0xffffffff
je 0x40158f
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
nop dword [eax]
push 0x404290
lea eax, [ebp - 0x63c]
push eax
call edi
test eax, eax
je 0x401568
push 0x404294
lea eax, [ebp - 0x63c]
push eax
call edi
test eax, eax
je 0x401568
test dword [ebp - 0x668], 0x400
jne 0x401568
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
mov ecx, dword [0x407414]
cmp ecx, 0x7fffffff
jg 0x4014db
mov eax, dword [0x407410]
jl 0x4014ca
cmp eax, 0xffffffff
jae 0x4014db
add eax, 1
mov dword [0x407410], eax
adc ecx, 0
mov dword [0x407414], ecx
test byte [ebp - 0x668], 0x10
je 0x40150c
push 0x404284
lea eax, [ebp - 0x210]
push eax
call esi
lea ecx, [ebp - 0x210]
call fcn.00401370
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x401568
lea ecx, [ebp - 0x210]
call fcn.00401180
test al, al
je 0x401568
mov ebx, dword [0x407414]
mov edi, dword [0x407410]
push 0
push 0xf
push ebx
push edi
call fcn.004034e0
mov ecx, eax
mov esi, edx
shld esi, ecx, 4
shl ecx, 4
sub ecx, eax
sbb esi, edx
sub edi, ecx
sbb ebx, esi
or edi, ebx
jne 0x401556
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ebx, dword [ebp - 0x66c]
lea eax, [ebp - 0x668]
push eax
push dword [ebp - 0x670]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401440
push dword [ebp - 0x670]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040277e
mov esp, ebp
pop ebp
ret
Function at 0x401940
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4035c8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x407008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
sub esp, 8
call fcn.00401b70
push ecx
inc eax
mov ecx, esi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00401a80
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00402160
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp eax, 8
jb 0x4019a9
inc eax
push eax
push dword [ebp - 0x40]
call fcn.00401cf0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp dword [esi + 0x14], 8
jb 0x4019bc
mov esi, dword [esi]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x14]
test eax, eax
setne bl
cmp ecx, 8
jb 0x4019dd
inc ecx
push ecx
push dword [ebp - 0x28]
call fcn.00401cf0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040277e
mov esp, ebp
pop ebp
ret

Function at 0x401a00
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x407008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
mov esi, edx
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401a6a
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401a37
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push str.Windows_XP_Tweaker_Tool_Applyer
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040277e
mov esp, ebp
pop ebp
ret
Function at 0x4a1b80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4c000]
push edi
or ebp, 0xffffffff
jmp 0x4a1ba2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a1ba9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a1b98
mov eax, 1
add ebx, ebx
jne 0x4a1bbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a1bcc
jne 0x4a1beb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a1beb
dec eax
add ebx, ebx
jne 0x4a1bd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a1bb0
add ebx, ebx
jne 0x4a1be7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a1c3d
xor ecx, ecx
sub eax, 3
jb 0x4a1c03
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a1c72
sar eax, 1
mov ebp, eax
jmp 0x4a1c0e
add ebx, ebx
jne 0x4a1c0e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a1bdc
inc ecx
add ebx, ebx
jne 0x4a1c1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a1bdc
add ebx, ebx
jne 0x4a1c29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a1c1e
jne 0x4a1c3a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a1c1e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a1c5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a1c4e
jmp 0x4a1b9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a1c5c
add edi, ecx
jmp 0x4a1b9e
pop esi
mov edi, esi
mov ecx, 7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a1c7a
cmp byte [edi], 0xaf
jne 0x4a1c7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a1c7f
lea edi, [esi + 0x9f000]
mov eax, dword [edi]
or eax, eax
je 0x4a1cf7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa1910]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa194c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a1cac
mov ecx, edi
jns 0x4a1cdb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa1950]
or eax, eax
je 0x4a1cf1
mov dword [ebx], eax
add ebx, 4
jmp 0x4a1cc9
call dword [esi + 0xa1960]
mov ebp, dword [esi + 0xa1954]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a1d2b
sub esp, 0xffffff80
jmp 0x4010bc
Function at 0x408063
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x471bc8]
jne 0x40806d
repz ret
jmp fcn.0040a927

Function at 0x40a11b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x471bc8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405bbd
and dword [ebp - 0x14], 0
cmp dword [0x4890fc], 0
mov dword [ebp - 0x18], eax
jne 0x40a1ce
push 0x402a8c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a276
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402a80
push ebx
call edi
test eax, eax
je 0x40a276
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402a70
push ebx
mov dword [0x4890fc], eax
call edi
push eax
call esi
push 0x402a5c
push ebx
mov dword [0x489100], eax
call edi
push eax
call esi
push 0x402a40
push ebx
mov dword [0x489104], eax
call edi
push eax
call esi
mov dword [0x48910c], eax
test eax, eax
je 0x40a1ce
push 0x402a28
push ebx
call edi
push eax
call esi
mov dword [0x489108], eax
mov eax, dword [0x489108]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40a227
cmp dword [0x48910c], ecx
je 0x40a227
push eax
call esi
push dword [0x48910c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40a227
test ebx, ebx
je 0x40a227
call edi
test eax, eax
je 0x40a21e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40a21e
test byte [ebp - 8], 1
jne 0x40a227
or dword [ebp + 0x10], 0x200000
jmp 0x40a25a
mov eax, dword [0x489100]
cmp eax, dword [ebp - 0x18]
je 0x40a25a
push eax
call esi
test eax, eax
je 0x40a25a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a25a
mov eax, dword [0x489104]
cmp eax, dword [ebp - 0x18]
je 0x40a25a
push eax
call esi
test eax, eax
je 0x40a25a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4890fc]
call esi
test eax, eax
je 0x40a276
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a278
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408063
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x47b93dbb
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6e3a35e0
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1258aaa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edx
push esi
jmp 0x102f36b
ret 4
cmp dword [esi + 0x30], 0
not dh
movzx edx, ax
mov edx, edi
jne 0x2097335
mov eax, dword [esi + 0xc]
inc ch
dec ebx
mov ecx, dword [esi + 0x24]
sub eax, dword [esi + 0x2c]
rcr bl, cl
sar bx, cl
mov ebx, edi
clc
sub ebx, ecx
jmp 0x126c162
call fcn.010df87b
test eax, eax
jne 0x20ae047
cmp dword [esi + 0x30], eax
jmp 0x2095a35
call fcn.0123b3fc
cmp dword [esi + 0x24], edi
jmp 0x2096b08
jb 0x10b1d99
mov dword [esi + 0x30], eax
mov edx, edi
jmp 0x102fda5
jb 0x10270ca
jmp 0x20ae031
push ebx
jmp 0x1006961
push ebp
mov ebp, esp
shr dl, 0xa7
push ebx
sub dh, dh
neg dh
push esi
or si, si
mov esi, eax
adc dx, bp
xor edx, 0x581b48b8
jmp 0x10270ca
cmp ebx, eax
jmp 0x2097325
jne 0x10b1d99
mov eax, dword [esi + 0xc]
test cx, cx
cmp dword [esi + 0x2c], eax
jmp 0x10b1d90
jae 0x20ae02b
cmp dword [esi + 0x18], ebx
jae 0x20ae02b
mov eax, 0x112
cmp si, 0x3b86
cmp si, cx
cmc
cmp dword [esi + 0x48], eax
jmp 0x10e655e
jbe 0x2097335
lea edx, [ecx + eax]
bswap bx
movzx bx, bl
mov ebx, dword [ebp + 8]
jmp 0x123527c
mov eax, 0x112
clc
cmp dword [esi + 0x48], eax
jbe 0x20ae042
mov dword [esi + 0x48], eax
test ebp, esp
sar bl, 0xa4
sub eax, eax
movzx ebp, cx
pop esi
xchg bp, bp
setle bl
movzx ebp, dx
pop ebx
pop ebp
jmp 0x1011497
Function at 0x2606125
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ax, 0xe9a4
stc
clc
test cx, 0x656a
add dl, dl
call fcn.026098c6

Function at 0x260820a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x2c]
jne 0x2610b92
lahf
call fcn.0158d04e
push es
sub dword [esi], 0x86a7b322
and dh, bh
mov eax, 0xa6c72ff7
mov bl, 0x1e
invalid

Function at 0x2610b98
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x287ef6a
pushal
sub esp, 0xfffffff8
rol ah, 6
aad 0x3b
push eax
cwde
mov dword [esp], esi
movzx ax, cl
pushal
mov dword [esp + 0x1c], edi
aas
aam 0x44
mov dword [esp + 0x18], ebx
inc ah
jmp 0x289c801
aas
lea ebp, [esp + 4]
add esp, 4
ja 0x260f94a
not eax
neg al
sbb ax, 0x6a4e
sub esp, 0x18
pushal
pushal
aam 0x78
rol al, cl
mov dword [esp + 0x3c], esi
shld ax, di, cl
mov dword [esp + 0x38], edi
shld ax, bp, 6
mov dword [esp + 0x34], ebx
cmp dh, 1
movsx ax, cl
shl ax, 7
mov dword [esp + 0x30], edx
adc ax, 0xbc20
mov eax, dword [ebp + 8]
cmp cx, si
clc
push dword [esp + 4]
test eax, eax
jmp 0x2607f91
xchg esp, eax
movsd dword es:[edi], dword [esi]
cmp eax, 0x372f30d0
pop edi
mov dl, 0xc1
lcall 0xc541, 0x41ec659e
mov al, 0xbb
ljmp 0x67e2
jge 0x287eed1
or bl, ah
movsd dword es:[edi], dword [esi]
salc
inc ecx
imul dl
mov byte [0xab43f53d], al
shr dword [edi - 0x6f], cl
inc edi
dec ebx
dec edx
push ecx
push edi
xor al, 0xf3
scasd eax, dword es:[edi]
pop edi
cli
mov ah, byte [0x23ed1ae4]
or eax, 0xa6d39dea
bound ecx, qword [ecx + 5]
test eax, 0x5f9b0044
dec ecx
add eax, 0x9b0044a9
pop edi
ficomp dword [ecx + eax*2 - 0x20]
mov dl, 8
jae 0x287ef64
invalid
lea esp, [esp + 0x34]
je 0x260e68c
adc dh, dh
mov esi, dword [eax + 0x3c]
movzx dx, cl
bswap dx
bsr dx, bx
add esi, eax
sbb dx, ax
mov edx, dword [esi + 0x78]
call int.0260c8a6
mov eax, dword es:[0x940fbbb4]
jb 0x287ef97
mov al, byte [0x7b0eb638]
pushal
sahf
movsd dword es:[edi], dword [esi]
sub cl, byte ss:[ebp + 0x54]
jg 0x287ef2f
in al, dx
jle 0x287ef56
das
inc esi
dec ebp
push esp
and eax, 0x3029fa75
push 0xc74b8ed
scasb al, byte es:[edi]
dec edi
push cs
jns 0x287efca
adc byte [eax + 0x1ef88ef6], ch
iretd
mov dword [edi + ebp + 0x97b5734], ebp
in al, 0xb5
sahf
ret 0x448f
bsr ax, bp
mov al, byte [esp + 8]
mov dword [esp + 0x14], edx
shld ax, si, 1
aad 0xe2
mov eax, dword [ebp + 8]
push dword [esp]
jmp fcn.02606137
Function at 0x28979ca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x289eb99
not dl
pushf
inc dl
mov dl, dl
sete dl
inc dl
mov dl, byte [esi]
clc
push 0xd34e3649
sub dl, 0x4a
call fcn.028949d7
xchg ebx, eax
push cs
sub dword [eax], esi
adc esp, esp
je 0x2606035
dec ebp
in eax, dx
jbe 0x260609a
mov ebp, 0xafbf4c1
adc dword [ebx + esi], ebp
pop esi
push esp
and eax, 0x857e4f48
movsb byte es:[edi], byte [esi]
stosd dword es:[edi], eax
mov esi, 0x88d7d0c5
jl 0x26060c5
xlatb
mov byte [ebp + esi - 0x5b], bh
movsd dword es:[edi], dword [esi]
stosb byte es:[edi], al
ror byte [ecx + edi*4 - 0x10], 0x42
sti
imul esi, dword [eax + 0x18], 0x62
hlt
sbb byte [edx - 0xc], ah
dec esi
sub al, 0xb8
add eax, 0x7dd7ac22
ja 0x26060d5
sub eax, 0xeb448b20
mov byte [ecx + 0x6fdeb89d], bl
arpl word [esi], si
pop esp
das
jmp fcn.02606137
out dx, al
cmp bh, byte [esi + ecx*8 + 0x1a]
test dword [ebx + esi*4 + 0x1cf85143], ebp
invalid
push ecx
clc
sbb al, 0x8f
fucompi st(2)
push ebp
and al, 0xab
inc ebp
jle 0x260608c
loop 0x26060bc
mov eax, dword [0xff75e5f5]
stosd dword es:[edi], eax
sbb al, byte [eax + 0x6a]
mov ecx, dword [esi + edi*4 + 0x5f]
loope 0x260615a
in eax, 0x75
jmp [ebx - 0x7495bfe6]
dec esp
mov esi, 0x8f78e15f
dec ebx
out 0xa9, al
or dword [esi + 0x5d00817c], edx
enter 0x1f84, 0xffffffffffffffe6
cld
sal dword [edx + 0x55], 1
cmp dword [edi + 0x6a], ebx
jno 0x2606154
invalid
cmp byte [edi], al
jbe 0x260617c
and edx, dword [ecx]
invalid
mov bh, 0x4b
shr byte [eax], cl
sub byte [ebx], 0x70
cmpsd dword [esi], dword es:[edi]
scasb al, byte es:[edi]
push ebx
inc edi
inc edx
dec ecx
pop esp
arpl word [edx - 0x7f], di
jp 0x26060dd
mov word [ebx + 0x7a7340bb], ss
mov dword [eax - 0x474e5d65], edx
dec esp
out 0xca, eax
jle 0x260614b
lcall 0x86f6, 0x493e8d2d
mov ebp, 0x34719a96
aad 0xa7
xor cl, byte [edx + 0x34]
pop edx
dec edx
xor al, 0x5a
jbe 0x2606186
leave
xchg ecx, eax
invalid
jnp 0x26061f9
sub al, 0xdc
add bl, byte [esi + 0x724f0881]
jns 0x260614f
inc edx
idiv byte [ecx + 0x3a]
adc edx, dword [eax + eax - 0x63]
xchg ebp, eax
arpl word [ecx], di
salc
out dx, eax
stosd dword es:[edi], eax
cmp esi, esp
adc byte [ecx + 0x35], cl
mov dword [0x19b2638b], eax
mov byte [0x7d82355d], al
cmp byte [edx], dh
dec esi
shl dword [edi + 0x67fcc30d], 0x1a
salc
xchg al, dl
lodsd eax, dword [esi]
mov ch, 0xdb
test bh, 0xd6
fnstsw word [ebp + 0x18]
movsb byte es:[edi], byte [esi]
pop ds
loopne 0x26061c2
invalid
ficomp word [eax - 0x3d]
out dx, al
cmc
movsd dword es:[edi], dword [esi]
inc eax
inc edx
pop ds
mov bh, 0x52
push cs
test eax, 0xaff30c71
cmp eax, 0xff64bc00
stosd dword es:[edi], eax
inc esi
or ah, byte [ebp - 0x458f2fcb]
pop esp
imul ebp, dword [esi - 0x2d], 0xf972bab6
sub al, 0x30
call fcn.0289feee
add byte [eax - 0x73], ah
and al, 0x24
pushfd
jmp 0x289b6ae
lea esp, [esp + 0xc]
jne 0x2896ca2
jmp 0x260604e
lea esp, [esp + 4]
ret
mov al, 0x10
jmp 0x289a638
pushal
mov word [esp + 0xc], ax
lea esp, [esp + 0x20]
jae 0x2881779
inc al
mov bl, 2
dec al
inc ecx
mov al, 0x1e
not al
not al
jmp 0x289b310
push 0x4a0dda81
pushfd
mov byte [esp], dl
lea esp, [esp + 0x30]
call fcn.02606125
jmp 0x289e04a
Function at 0x289be71
Capabilities:
Encode data using xor

Disassembly:
and al, 0x8d
and al, 8
call fcn.0289569d
adc byte [ebx - 0x646b6e76], cl
dec edi
call dword [eax]
mov ecx, dword [edx + 0x4f9b9491]
popfd
add al, 0x23
or ecx, dword [eax + eax + 0x24]
xor dword [eax + ecx*8 - 0x40949bb3], ebx
inc esp
nop
adc eax, 0xd4e0231c
mov bh, 0x88
mov eax, 0x767b743d
jge 0x289be7e
jne 0x289bec9
call 0x280af955
mov edx, edx
in eax, dx
or dword [eax + 0x5f], esi
jg 0x289be75
invalid
popfd
test byte [ecx - 0x325157d3], cl
push edi
jb 0x289be54
invalid
Function at 0x401080
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
call fcn.00401760
add esp, 0x190
ret

Function at 0x4010b0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov ebx, ecx
push 0x10c
call fcn.004018cb
mov esi, eax
add esp, 4
test esi, esi
je 0x401108
push edi
mov ecx, 0x43
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
push esi
mov ecx, ebx
call fcn.00401000
test eax, eax
pop edi
jne 0x4010ff
cmp byte [esi], 0
je 0x4010ee
push 5
push esi
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [esi + 0x108]
test eax, eax
jbe 0x4010ff
mov ecx, ebx
call fcn.00401080
push esi
call fcn.004018c0
add esp, 4
pop esi
pop ebx
ret

Function at 0x4011d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
cmp edi, 4
jb 0x40120e
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, 4
mov ecx, 0x48f086f9
sub esi, eax
mov ebx, dword [eax]
xor edx, ecx
xor ebx, edx
add ecx, 0x209444
mov dword [eax], ebx
add eax, 4
lea ebx, [esi + eax]
cmp ebx, edi
jbe 0x4011f0
pop esi
pop ebx
xor eax, eax
pop edi
ret
xor eax, eax
pop edi
ret