joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100080a7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10008144
push ebx
push esi
call fcn.10008070
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10008004
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100080f1
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10008143
push edi
push eax
call fcn.10008ff5
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10008111
call fcn.10006272
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10008142
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10008004
add esp, 0x20
test eax, eax
jne 0x10008130
push edi
call fcn.10006272
jmp 0x10008138
push ebx
call fcn.10006272
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10008344
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000fa48
push 0x1000fa40
push 0x1000ecbc
push 0x1f
call fcn.10008260
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008378
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000e11c]
call esi
jmp 0x1000837e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100083c2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000fa58
push 0x1000fa50
push 0x1000ece0
push 0x21
call fcn.10008260
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100083f9
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000e11c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10008401
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000fa60
push 0x1000fa58
push 0x1000ecf4
push 0x22
call fcn.10008260
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000843b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000e11c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000d9a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000d9cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000d9cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x30024a40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x20000]
push edi
jmp 0x30024a5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x30024a61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x30024a50
mov eax, 1
add ebx, ebx
jne 0x30024a73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x30024a68
jne 0x30024a84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x30024a68
xor ecx, ecx
sub eax, 3
jb 0x30024a98
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x30024b0a
mov ebp, eax
add ebx, ebx
jne 0x30024aa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x30024ab0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x30024ad4
inc ecx
add ebx, ebx
jne 0x30024ac0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x30024ab5
jne 0x30024ad1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x30024ab5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x30024af4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x30024ae5
jmp 0x30024a56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x30024af4
add edi, ecx
jmp 0x30024a56
pop esi
mov edi, esi
mov ecx, 0x114
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x30024b12
cmp byte [edi], 4
jne 0x30024b12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x30024b17
lea edi, [esi + 0x22000]
mov eax, dword [edi]
or eax, eax
je 0x30024b8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x24578]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x24620]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x30024b44
mov ecx, edi
jns 0x30024b73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x24628]
or eax, eax
je 0x30024b89
mov dword [ebx], eax
add ebx, 4
jmp 0x30024b61
call dword [esi + 0x24624]
mov ebp, dword [esi + 0x2462c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x30024bc3
sub esp, 0xffffff80
jmp 0x30006139
Function at 0x402150
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40219b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402194
test esi, esi
je 0x402194
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402170
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402380
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4023d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4024a8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40240e
cmp eax, 4
jne 0x402430
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40241e
cmp edx, 4
je 0x40241e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402380
Function at 0x10054560
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1005474d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3f000]
push edi
or ebp, 0xffffffff
jmp 0x1005458a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10054591
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10054580
mov eax, 1
add ebx, ebx
jne 0x100545a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100545b4
jne 0x100545d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100545d3
dec eax
add ebx, ebx
jne 0x100545c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10054598
add ebx, ebx
jne 0x100545cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10054625
xor ecx, ecx
sub eax, 3
jb 0x100545eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1005465a
sar eax, 1
mov ebp, eax
jmp 0x100545f6
add ebx, ebx
jne 0x100545f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100545c4
inc ecx
add ebx, ebx
jne 0x10054604
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100545c4
add ebx, ebx
jne 0x10054611
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10054606
jne 0x10054622
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10054606
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10054644
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10054636
jmp 0x10054586
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10054644
add edi, ecx
jmp 0x10054586
pop esi
mov edi, esi
mov ecx, 0x9bb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10054662
cmp byte [edi], 5
jne 0x10054662
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10054667
lea edi, [esi + 0x4c000]
mov eax, dword [edi]
or eax, eax
je 0x100546df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x54488]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x54644]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10054694
mov ecx, edi
jns 0x100546c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x54648]
or eax, eax
je 0x100546d9
mov dword [ebx], eax
add ebx, 4
jmp 0x100546b1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10054710
cmp al, 0xef
ja 0x10054703
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100546e5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100546f2
mov ebp, dword [esi + 0x5464c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10054744
sub esp, 0xffffff80
jmp 0x1001b736
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x433970
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2e000]
push edi
jmp 0x43398a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x433991
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x433980
mov eax, 1
add ebx, ebx
jne 0x4339a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x433998
jne 0x4339b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x433998
xor ecx, ecx
sub eax, 3
jb 0x4339c8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x433a3a
mov ebp, eax
add ebx, ebx
jne 0x4339d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4339e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x433a04
inc ecx
add ebx, ebx
jne 0x4339f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4339e5
jne 0x433a01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4339e5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x433a24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x433a15
jmp 0x433986
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x433a24
add edi, ecx
jmp 0x433986
pop esi
mov edi, esi
mov ecx, 0x26d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x433a42
cmp byte [edi], 0
jne 0x433a42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x433a47
lea edi, [esi + 0x31000]
mov eax, dword [edi]
or eax, eax
je 0x433abf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x36d44]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x36dfc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x433a74
mov ecx, edi
jns 0x433aa3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x36e04]
or eax, eax
je 0x433ab9
mov dword [ebx], eax
add ebx, 4
jmp 0x433a91
call dword [esi + 0x36e00]
mov ebp, dword [esi + 0x36e08]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x433af3
sub esp, 0xffffff80
jmp 0x403235
Function at 0x100424a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100424af
pop dword [ebp - 0x18]
mov eax, 0x1e6ef849
add eax, 0xf1952c66
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xe3e85ae1
add dword [ebp - 0x28], 0x6a69ea6a
mov dword [ebp - 0x24], 0x6886d853
sub dword [ebp - 0x24], 0x36538c0e
mov dword [ebp - 0x20], 0x452e95b7
sub dword [ebp - 0x20], 0xf8e25189
mov dword [ebp - 0x1c], 0x63b6261e
add dword [ebp - 0x1c], 0x9c49d9e2
lea eax, [ebp - 0x28]
push eax
mov eax, 0x9a3a422e
add eax, 0x75ce2e06
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xc6b1d0c2
sub dword [ebp - 0x28], 0x523f676c
mov dword [ebp - 0x24], 0xa0e2f561
sub dword [ebp - 0x24], 0x5f7693ec
mov dword [ebp - 0x20], 0xb0591a09
sub dword [ebp - 0x20], 0x4ce9ad9d
mov dword [ebp - 0x1c], 0xb6d28bcc
add dword [ebp - 0x1c], 0x492d7434
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xcbb99ff9
sub eax, 0xbbb12fd5
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3f94e
push 0
call eax
mov ecx, 0x502e
xor esi, esi
add esi, eax
mov edi, 0xec4de49d
add edi, 0x23bdab63
add edi, dword [ebp - 0x18]
mov edx, 0xd8836860
sub edx, 0xd9e5c2fc
mov ebx, dword [edi]
xor dword [ebp - 0xc], edx
sub ebx, edx
sub dword [ebp - 0x14], eax
mov dword [esi], ebx
add dword [ebp - 0xc], 0x78c2f1e
add esi, 0x77d320b
sub esi, 0x77d3207
add edi, 0x1b34d296
add edi, 0xe4cb2d6e
loop 0x100425cd
add eax, 0x957c7e08
add eax, 0x6a84b583
xor ebx, ebx
add ebx, eax
add eax, 0xc3932299
sub eax, 0xc3932294
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4239b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movsd dword es:[edi], dword [esi]
cmp eax, 0xfffffc
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004230c7
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042307c
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b

Function at 0x423cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebx
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.004230c7
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042307c
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.004230b7
add dword [ecx + 0x468e000], 0x8d000001
test esp, ecx
cld
invalid
Function at 0x401e30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40728c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x407284]
sub esp, 4
test ebx, ebx
je 0x401e85
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401e7e
test esi, esi
je 0x401e7e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e60
mov dword [esp], 0x40728c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4021c0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4021e5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4021f0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4021e5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402238
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40222e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40223a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402220
xor eax, eax
pop ebx
pop esi
ret
Function at 0x403004
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
call sub.kernel32.dll_WriteFile
test eax, eax
setne al
movsx eax, al
push eax
call fcn.00402ea4
mov esi, eax
cmp dword [0x407ec0], 0xffffffff
je 0x403065
mov eax, dword [ebp + 0x14]
cmp eax, dword [0x407ebc]
jne 0x403065
lea eax, [ebp - 0x1c]
push eax
push dword [0x407ebc]
call sub.kernel32.dll_GetConsoleScreenBufferInfo
movsx eax, word [ebp - 0x18]
mov dword [0x407ec8], eax
movsx eax, word [ebp - 0x16]
mov dword [0x407ecc], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40317c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push esi
push edi
mov edi, 3
push 0x408a1c
call fcn.004062e0
mov esi, dword [eax]
push 0x408a1c
call fcn.004062e0
mov dword [eax], 0x40
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x38c]
push eax
push 0
call fcn.00405b48
call fcn.004059c4
lea eax, [ebp - 0x150]
push eax
push 1
call fcn.00405a50
call fcn.00404608
test eax, eax
jne 0x4032bd
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 0x40
push 0
call fcn.00405b28
call fcn.00404608
test eax, eax
jne 0x403233
cmp word [ebp - 0x190], 0x5a4d
jne 0x403233
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00405a6c
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 2
push 0
call fcn.00405b28
jmp 0x40323d
mov dword [ebp - 0x154], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00405a6c
call fcn.00404608
test eax, eax
jne 0x4032a1
cmp word [ebp - 0x190], 0x4550
jne 0x4032a1
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x288]
push eax
push 0xf8
push 0
call fcn.00405b28
call fcn.00404608
test eax, eax
jne 0x4032a1
cmp dword [ebp - 0x288], 0x4550
jne 0x4032a1
cmp word [ebp - 0x22c], 3
jne 0x4032a1
mov edi, 2
lea eax, [ebp - 0x150]
push eax
call fcn.00405a9c
push 0x408a14
call fcn.004062e0
mov dword [eax], 0
push 0x408a1c
call fcn.004062e0
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403314
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
call sub.kernel32.dll_CreateThread
mov esi, eax
push esi
call sub.kernel32.dll_CloseHandle
test esi, esi
setne al
movsx eax, al
push eax
call fcn.00402ea4
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x4033b8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
cmp dword [0x407f60], 0
je 0x4033da
mov eax, dword [0x407f60]
mov dword [ebp - 4], eax
jmp 0x40346f
push 0x104
call fcn.004046dc
mov dword [ebp - 4], eax
push 0x104
push dword [ebp - 4]
push 0
call sub.kernel32.dll_GetModuleFileNameA
push dword [ebp - 4]
call fcn.004041a4
inc eax
mov ebx, eax
call sub.kernel32.dll_GetCommandLineA
mov esi, eax
mov al, byte [esi]
dec al
cmp al, 0x1f
jbe 0x40341f
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.00403350
mov esi, eax
inc esi
push esi
call fcn.004041a4
inc eax
mov edi, eax
lea eax, [ebp - 4]
push eax
mov eax, ebx
add eax, edi
inc eax
push eax
call fcn.0040473c
call sub.kernel32.dll_AreFileApisANSI
test eax, eax
jne 0x403450
push edi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push esi
call sub.user32.dll_CharToOemBuffA
jmp 0x40345d
push esi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push edi
call fcn.00404f1c
mov eax, dword [ebp - 4]
add eax, ebx
add eax, edi
mov byte [eax], 0
mov eax, dword [ebp - 4]
mov dword [0x407f60], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40354c
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x24], 0x52414853
mov dword [ebp - 0x20], 0x454d4445
mov dword [ebp - 0x1c], 0x5356354d
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0xb
call fcn.00404e90
xor eax, eax
mov bl, 0
cmp dword [0x407f04], 0
jne 0x40359a
push 0x407c54
push 1
call fcn.00402db0
mov dword [0x407f04], eax
cmp dword [0x407f04], 0
jne 0x4035b3
push 0x8000
call fcn.004046dc
mov esi, eax
mov bl, 1
jmp 0x4035ed
lea eax, [ebp - 0x24]
push eax
push 0
push 6
call dword [0x407f04]
test eax, eax
jne 0x4035dd
lea eax, [ebp - 0x24]
push eax
push 0x8000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov bl, 1
push 0
push 0
push 0
push 6
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test bl, bl
je 0x403616
push esi
push 0x8000
push 0xff
call fcn.00404f78
push esi
push 0x24
push 0
call fcn.00404f78
mov eax, esi
add eax, 0xc
push eax
call fcn.004047c4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret