joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a78bb98
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6b118014]
mov dword [ebp - 0xc], eax
jmp 0x6a78bc7b
jmp 0x6a78bd50
jmp 0x6a78be25
jmp 0x6a78befa
jmp 0x6a78bfcf
jmp 0x6a78c0a4
jmp 0x6a78c179
jmp 0x6a78c24e
jmp 0x6a78c323
jmp 0x6a78c3f8
jmp 0x6a78c4cd
jmp 0x6a78c5a2
jmp 0x6a78c677
jmp 0x6a78c74c
jmp 0x6a78c821
jmp 0x6a78c8f6
jmp 0x6a78c9cb
jmp 0x6a78caa0
jmp 0x6a78cb75
jmp 0x6a78cc4a
jmp 0x6a78cd1f
jmp 0x6a78cdf4
jmp 0x6a78cec9
jmp 0x6a78cf9e
jmp 0x6a78d073
cmp dword [ebp - 0xc], 0
je 0x6a792403
mov eax, dword [0x6b118014]
mov dword [0x6b11800c], eax
jmp 0x6a78d15c
jmp 0x6a78d231
jmp 0x6a78d306
jmp 0x6a78d3db
jmp 0x6a78d4b0
jmp 0x6a78d585
jmp 0x6a78d65a
jmp 0x6a78d72f
jmp 0x6a78d804
jmp 0x6a78d8d9
jmp 0x6a78d9ae
jmp 0x6a78da83
jmp 0x6a78db58
jmp 0x6a78dc2d
jmp 0x6a78dd02
jmp 0x6a78ddd7
jmp 0x6a78deac
jmp 0x6a78df81
jmp 0x6a78e056
jmp 0x6a78e12b
jmp 0x6a78e200
jmp 0x6a78e2d5
jmp 0x6a78e3aa
jmp 0x6a78e47f
jmp 0x6a78e554
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [0x6b118008], eax
jmp 0x6a78e639
jmp 0x6a78e70e
jmp 0x6a78e7e3
jmp 0x6a78e8b8
jmp 0x6a78e98d
jmp 0x6a78ea62
jmp 0x6a78eb37
jmp 0x6a78ec0c
jmp 0x6a78ece1
jmp 0x6a78edb6
jmp 0x6a78ee8b
jmp 0x6a78ef60
jmp 0x6a78f035
jmp 0x6a78f10a
jmp 0x6a78f1df
jmp 0x6a78f2b4
jmp 0x6a78f389
jmp 0x6a78f45e
jmp 0x6a78f533
jmp 0x6a78f608
jmp 0x6a78f6dd
jmp 0x6a78f7b2
jmp 0x6a78f887
jmp 0x6a78f95c
jmp 0x6a78fa31
mov eax, dword [0x6b118008]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x6a78fb11
jmp 0x6a78fbe6
jmp 0x6a78fcbb
jmp 0x6a78fd90
jmp 0x6a78fe65
jmp 0x6a78ff3a
jmp 0x6a79000f
jmp 0x6a7900e4
jmp 0x6a7901b9
jmp 0x6a79028e
jmp 0x6a790363
jmp 0x6a790438
jmp 0x6a79050d
jmp 0x6a7905e2
jmp 0x6a7906b7
jmp 0x6a79078c
jmp 0x6a790861
jmp 0x6a790936
jmp 0x6a790a0b
jmp 0x6a790ae0
jmp 0x6a790bb5
jmp 0x6a790c8a
jmp 0x6a790d5f
jmp 0x6a790e34
jmp 0x6a790f09
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [0x6b118004], eax
jmp 0x6a79100b
jmp 0x6a7910e0
jmp 0x6a7911b5
jmp 0x6a79128a
jmp 0x6a79135f
jmp 0x6a791434
jmp 0x6a791509
jmp 0x6a7915de
jmp 0x6a7916b3
jmp 0x6a791788
jmp 0x6a79185d
jmp 0x6a791932
jmp 0x6a791a07
jmp 0x6a791adc
jmp 0x6a791bb1
jmp 0x6a791c86
jmp 0x6a791d5b
jmp 0x6a791e30
jmp 0x6a791f05
jmp 0x6a791fda
jmp 0x6a7920af
jmp 0x6a792184
jmp 0x6a792259
jmp 0x6a79232e
jmp 0x6a792403
nop
leave
ret
Function at 0x6a794de4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6b118008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6b118008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6a794ed9
jmp 0x6a794fae
jmp 0x6a795083
jmp 0x6a795158
jmp 0x6a79522d
jmp 0x6a795302
jmp 0x6a7953d7
jmp 0x6a7954ac
jmp 0x6a795581
jmp 0x6a795656
jmp 0x6a79572b
jmp 0x6a795800
jmp 0x6a7958d5
jmp 0x6a7959aa
jmp 0x6a795a7f
jmp 0x6a795b54
jmp 0x6a795c29
jmp 0x6a795cfe
jmp 0x6a795dd3
jmp 0x6a795ea8
jmp 0x6a795f7d
jmp 0x6a796052
jmp 0x6a796127
jmp 0x6a7961fc
jmp 0x6a7962d1
mov dword [ebp - 0x14], 0
jmp 0x6a7963ad
jmp 0x6a796482
jmp 0x6a796557
jmp 0x6a79662c
jmp 0x6a796701
jmp 0x6a7967d6
jmp 0x6a7968ab
jmp 0x6a796980
jmp 0x6a796a55
jmp 0x6a796b2a
jmp 0x6a796bff
jmp 0x6a796cd4
jmp 0x6a796da9
jmp 0x6a796e7e
jmp 0x6a796f53
jmp 0x6a797028
jmp 0x6a7970fd
jmp 0x6a7971d2
jmp 0x6a7972a7
jmp 0x6a79737c
jmp 0x6a797451
jmp 0x6a797526
jmp 0x6a7975fb
jmp 0x6a7976d0
jmp 0x6a7977a5
mov dword [ebp - 0x18], 0
jmp 0x6a797881
jmp 0x6a797956
jmp 0x6a797a2b
jmp 0x6a797b00
jmp 0x6a797bd5
jmp 0x6a797caa
jmp 0x6a797d7f
jmp 0x6a797e54
jmp 0x6a797f29
jmp 0x6a797ffe
jmp 0x6a7980d3
jmp 0x6a7981a8
jmp 0x6a79827d
jmp 0x6a798352
jmp 0x6a798427
jmp 0x6a7984fc
jmp 0x6a7985d1
jmp 0x6a7986a6
jmp 0x6a79877b
jmp 0x6a798850
jmp 0x6a798925
jmp 0x6a7989fa
jmp 0x6a798acf
jmp 0x6a798ba4
jmp 0x6a798c79
mov dword [ebp - 0x10], 0
jmp 0x6a798d55
jmp 0x6a798e2a
jmp 0x6a798eff
jmp 0x6a798fd4
jmp 0x6a7990a9
jmp 0x6a79917e
jmp 0x6a799253
jmp 0x6a799328
jmp 0x6a7993fd
jmp 0x6a7994d2
jmp 0x6a7995a7
jmp 0x6a79967c
jmp 0x6a799751
jmp 0x6a799826
jmp 0x6a7998fb
jmp 0x6a7999d0
jmp 0x6a799aa5
jmp 0x6a799b7a
jmp 0x6a799c4f
jmp 0x6a799d24
jmp 0x6a799df9
jmp 0x6a799ece
jmp 0x6a799fa3
jmp 0x6a79a078
jmp 0x6a79a14d
mov dword [ebp - 0x10], 0
jmp 0x6a7a09a0
jmp 0x6a79a22e
jmp 0x6a79a303
jmp 0x6a79a3d8
jmp 0x6a79a4ad
jmp 0x6a79a582
jmp 0x6a79a657
jmp 0x6a79a72c
jmp 0x6a79a801
jmp 0x6a79a8d6
jmp 0x6a79a9ab
jmp 0x6a79aa80
jmp 0x6a79ab55
jmp 0x6a79ac2a
jmp 0x6a79acff
jmp 0x6a79add4
jmp 0x6a79aea9
jmp 0x6a79af7e
jmp 0x6a79b053
jmp 0x6a79b128
jmp 0x6a79b1fd
jmp 0x6a79b2d2
jmp 0x6a79b3a7
jmp 0x6a79b47c
jmp 0x6a79b551
jmp 0x6a79b626
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6b118004]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6a79b70c
jmp fcn.6a79b7e1
mov eax, dword [0x6b118008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6a79a159
nop
leave
ret

Function at 0x6a7db8b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x6b117040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6a7db910
Function at 0x6a7db910
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6b118378]
test esi, esi
jle 0x6a7db9fd
mov edi, dword [0x6b11837c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6a7db944
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6a7db9f6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x6a7db930
mov dword [esp], eax
mov esi, eax
call fcn.6a7dc0b0
test eax, eax
mov edi, eax
je 0x6a7dba3a
mov esi, dword [0x6b11837c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.6a7dc1c0
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x6b11837c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6a7dba1a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x6a7db9ef
sub eax, 0x40
and eax, 0xffffffbf
je 0x6a7db9ef
mov eax, dword [esp + 0x20]
add ebx, dword [0x6b11837c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x6a7dba04
add dword [0x6b118378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x6a7db94e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6a7db8b0
mov eax, dword [0x6b11837c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6a7db8b0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6a7db8b0
lea esi, [esi]

Function at 0x6a7dbd20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6b118388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6b118380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x6a7dbd75
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6a7dbd6e
test esi, esi
je 0x6a7dbd6e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6a7dbd50
mov dword [esp], 0x6b118388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4c0520
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x800e5f
jmp 0x7f2188
rdtsc
jmp 0x7f218f
jmp fcn.007f3e26
jmp 0x7f5a9f
xchg ecx, esi
not esi
xchg ecx, esi
and ecx, 0x571b90b2
jns 0x7f5a31
jmp 0x7f59d2
push ebx
push dword [esp]
mov eax, dword [esp]
add esp, 4
push edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
push ebx
push dword [esp]
mov eax, dword [esp]
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
add esp, 4
push eax
mov eax, esp
add eax, 4
sub eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
mov dword [esp], ecx
mov edx, dword [esp]
add esp, 4
jmp 0x7f5a9f
add ecx, 0xffefefe2
add edi, ecx
pop ecx
sub edi, 0x14
xchg dword [esp], edi
pop esp
jmp 0x7f5b0f
push 0x7ab28396
mov dword [esp], edi
mov edi, esp
push 0x7281f3e7
mov dword [esp], ecx
mov ecx, 0x7fafacd4
jmp 0x7f59bb
jmp 0x819388
jmp 0x7fa18d
pop ebp
push dword [esp]
pop ebp
add esp, 4
jmp 0x7fa245
sub esp, 4
mov dword [esp], esp
push ebp
mov ebp, 4
add dword [esp + 4], ebp
jmp 0x7fa180
jmp 0x7f59b6
jmp 0x7fca8a
sub esp, 4
mov dword [esp], esi
push ebp
mov ebp, 0x281dd63d
mov dword [esp + 4], ebp
pop ebp
mov dword [esp], eax
mov dword [esp], ecx
jmp 0x7fcb05
jmp 0x8027b6
jmp 0x800f08
push edi
mov dword [esp], ebx
mov dword [esp], ebp
mov dword [esp], edx
mov dword [esp], ebp
jmp 0x800f6b
jmp 0x7fa126
jmp 0x80288a
add edi, ecx
pop ecx
push ebp
mov ebp, 4
sub edi, ebp
pop ebp
xchg dword [esp], edi
pop esp
mov dword [esp], edx
jmp 0x8028ef
push 0x6fcec34e
mov dword [esp], edi
mov edi, esp
push ecx
mov ecx, 4
jmp 0x8027bb
jmp 0x7f207c
jmp 0x81949a
pop edi
push ebx
push dword [esp + 4]
pop ebx
pop dword [esp]
pop esp
mov dword [esp], edx
mov dword [esp], ebx
jmp 0x8194b0
push ebx
mov ebx, esp
add ebx, 4
push edi
mov edi, 4
sub ebx, edi
jmp 0x8193e0
jmp 0x7fc9d4
Function at 0x401000
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x854
push ebx
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x60]
push 0x400
push eax
push 0
mov dword [esp + 0x28], 0x44
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0x60]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
test ecx, ecx
jle 0x401056
mov al, byte [esp + ecx + 0x60]
mov byte [esp + ecx + 0x60], 0
cmp al, 0x5c
je 0x401056
dec ecx
test ecx, ecx
jg 0x401044
lea edi, [esp + 0x60]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
test ecx, ecx
jle 0x40107b
cmp byte [esp + ecx + 0x60], 0x5c
je 0x40107b
mov byte [esp + ecx + 0x60], 0
dec ecx
test ecx, ecx
jg 0x40106a
or ecx, 0xffffffff
mov edi, str.FSCOMMAND_
xor eax, eax
lea edx, [esp + 0x60]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x460]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x60]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x460]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [str.DW_Client_Installer.exe]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x64]
push ecx
push edx
push 0
push 0x4000020
push 0
push 0
push 0
lea eax, [esp + 0x480]
push 0x4054d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x854
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x407ef8
nop
mov ecx, 0x2d5d75e7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x42cd70
nop
nop
mov ecx, 0xb481217
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x62a42be2
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x63411014]
mov dword [ebp - 0xc], eax
jmp 0x62a42c18
jmp 0x62a42c40
jmp 0x62a42c68
jmp 0x62a42c90
jmp 0x62a42cb8
jmp 0x62a42ce0
jmp 0x62a42d08
jmp 0x62a42d30
jmp 0x62a42d58
jmp 0x62a42d80
jmp 0x62a42da8
jmp 0x62a42dd0
jmp 0x62a42df8
jmp 0x62a42e20
jmp 0x62a42e48
jmp 0x62a42e70
jmp 0x62a42e98
jmp 0x62a42ec0
cmp dword [ebp - 0xc], 0
je 0x62a43a5c
mov eax, dword [0x63411014]
mov dword [0x6341100c], eax
jmp 0x62a42efc
jmp 0x62a42f24
jmp 0x62a42f4c
jmp 0x62a42f74
jmp 0x62a42f9c
jmp 0x62a42fc4
jmp 0x62a42fec
jmp 0x62a43014
jmp 0x62a4303c
jmp 0x62a43064
jmp 0x62a4308c
jmp 0x62a430b4
jmp 0x62a430dc
jmp 0x62a43104
jmp 0x62a4312c
jmp 0x62a43154
jmp 0x62a4317c
jmp 0x62a431a4
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [0x63411008], eax
jmp 0x62a431dc
jmp 0x62a43204
jmp 0x62a4322c
jmp 0x62a43254
jmp 0x62a4327c
jmp 0x62a432a4
jmp 0x62a432cc
jmp 0x62a432f4
jmp 0x62a4331c
jmp 0x62a43344
jmp 0x62a4336c
jmp 0x62a43394
jmp 0x62a433bc
jmp 0x62a433e4
jmp 0x62a4340c
jmp 0x62a43434
jmp 0x62a4345c
jmp 0x62a43484
mov eax, dword [0x63411008]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x62a434b7
jmp 0x62a434df
jmp 0x62a43507
jmp 0x62a4352f
jmp 0x62a43557
jmp 0x62a4357f
jmp 0x62a435a7
jmp 0x62a435cf
jmp 0x62a435f7
jmp 0x62a4361f
jmp 0x62a43647
jmp 0x62a4366f
jmp 0x62a43697
jmp 0x62a436bf
jmp 0x62a436e7
jmp 0x62a4370f
jmp 0x62a43737
jmp 0x62a4375f
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [0x63411004], eax
jmp 0x62a437b4
jmp 0x62a437dc
jmp 0x62a43804
jmp 0x62a4382c
jmp 0x62a43854
jmp 0x62a4387c
jmp 0x62a438a4
jmp 0x62a438cc
jmp 0x62a438f4
jmp 0x62a4391c
jmp 0x62a43944
jmp 0x62a4396c
jmp 0x62a43994
jmp 0x62a439bc
jmp 0x62a439e4
jmp 0x62a43a0c
jmp 0x62a43a34
jmp 0x62a43a5c
nop
leave
ret

Function at 0x62a4dfb0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x63410040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.62a4e010
Function at 0x62a4e010
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x63411378]
test esi, esi
jle 0x62a4e0fd
mov edi, dword [0x6341137c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x62a4e044
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x62a4e0f6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x62a4e030
mov dword [esp], eax
mov esi, eax
call fcn.62a4e7b0
test eax, eax
mov edi, eax
je 0x62a4e13a
mov esi, dword [0x6341137c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.62a4e8c0
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x6341137c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x62a4e11a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x62a4e0ef
sub eax, 0x40
and eax, 0xffffffbf
je 0x62a4e0ef
mov eax, dword [esp + 0x20]
add ebx, dword [0x6341137c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x62a4e104
add dword [0x63411378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x62a4e04e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.62a4dfb0
mov eax, dword [0x6341137c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.62a4dfb0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.62a4dfb0
lea esi, [esi]

Function at 0x62a4e420
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x63411388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x63411380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x62a4e475
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x62a4e46e
test esi, esi
je 0x62a4e46e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x62a4e450
mov dword [esp], 0x63411388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x402a54
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x402a91
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x402ab1
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404d80
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402c88
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404b00
test esi, esi
jne 0x402cbe
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404bf0
jmp 0x402cdc
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402b9c
mov edi, eax
test esi, esi
je 0x402cdc
cmp dword [ebx], 0
je 0x402cdc
dec esi
jmp 0x402cc5
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403348
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x628008], 0x8088405
inc edx
mov dword [ebx + 0x628008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x628024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403b98
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403b78
xor eax, eax
push ebp
push 0x403b71
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403bb4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403b78
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x628024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x628024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404984
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x62e04c], 0
je 0x4049e5
cmp word [0x62e220], 0xd7b2
jne 0x4049ad
cmp dword [0x62e228], 0
jbe 0x4049ad
mov eax, 0x62e21c
call dword [0x62e238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x62807c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404a0c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x628034], 0
jne 0x404a01
push 0
push 0x628074
push 0x62807c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret