joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bed0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44bf03
push esi
call fcn.0045a270
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44befc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44bf89
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44bf72
mov eax, dword [esi + 8]
test eax, eax
je 0x44bf27
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44bf6e
cmp eax, 2
je 0x44bf72
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44bf1a
cmp eax, 3
je 0x44bf4d
cmp eax, 1
jne 0x44bf1a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44bf1a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44bf1a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044bfb0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44bf98
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044bfb0
add esp, 4
pop esi
ret

Function at 0x44c820
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x44c841
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x44c841
mov eax, dword [eax + 0x44]
test eax, eax
je 0x44c841
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x47a3cb
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47a403
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00478482
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047845a
jmp 0x47a40f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47bab9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47bafb
call fcn.00481575
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47bafb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47baf2
xor eax, eax
jmp 0x47bb03
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047bb09
pop edi
pop esi
pop ebx
ret 4
Function at 0x481aa5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x481ad3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x481af1
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00481a0b
jmp 0x481af1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x481af1
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00481a0b
test edi, edi
mov eax, edi
jne 0x481adb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401080
Capabilities:
Print debug messages

Disassembly:
push esi
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
mov esi, section..data
push esi
call dword [sym.imp.USER32.dll_wvsprintfA]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x200010
push str.TSU_Loader
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
ret

Function at 0x401111
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ecx, eax
test ecx, ecx
mov dword [ebp - 4], ecx
je 0x4011e6
push ebx
call section..text
mov ebx, eax
push ebx
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4011dc
push esi
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push ebx
call esi
test eax, eax
je 0x4011db
cmp dword [ebp - 4], 4
jb 0x4011db
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x90]
push str.StringFileInfo_04x_04xArguments
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
call esi
test eax, eax
je 0x4011db
cmp dword [ebp - 8], edi
je 0x4011db
mov eax, dword [ebp - 4]
test eax, eax
je 0x4011db
lea ecx, [eax + eax + 2]
call section..text
push dword [ebp - 4]
mov edi, eax
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 4]
and word [edi + eax*2], 0
pop esi
mov ecx, ebx
call fcn.00401010
mov eax, edi
pop ebx
pop edi
leave
ret 4
Function at 0x4011eb
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x401218
xor eax, eax
jmp 0x4013b3
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x10000
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jae 0x401234
dec ecx
mov dword [ebp - 8], ecx
push ebx
push esi
push edi
push edi
push edi
lea esi, [eax - 0x10000]
push 2
push edi
push dword [ebp - 4]
and esi, 0xffff0000
sub eax, esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 8], eax
call edi
cmp dword [ebp + 8], 0
je 0x401287
push ebx
push esi
push dword [ebp - 8]
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [ebp + 8]
mov esi, eax
mov dword [ebp - 4], esi
call edi
test esi, esi
jne 0x40128e
xor eax, eax
jmp 0x4013b1
lea ecx, [esi + ebx]
push 0x7c
lea eax, [ecx - 2]
pop edx
xor ebx, ebx
cmp byte [eax], dl
lea edi, [ecx - 4]
jne 0x40133b
cmp byte [eax + 1], 0x3e
jne 0x40133b
mov edi, dword [ebp - 4]
add edi, 2
cmp eax, edi
mov esi, eax
jbe 0x4013a6
lea ecx, [esi - 1]
cmp byte [ecx], dl
jne 0x4012cb
cmp byte [esi - 2], 0x3c
je 0x4012d6
mov esi, ecx
cmp esi, edi
ja 0x4012be
jmp 0x4013a6
sub eax, esi
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 5
cmp esi, eax
jbe 0x40131c
cmp byte [esi - 5], 0xef
jne 0x40131c
cmp byte [esi - 4], 0xbb
jne 0x40131c
cmp byte [esi - 3], 0xbf
jne 0x40131c
lea ecx, [edi + edi + 2]
call section..text
push edi
mov ebx, eax
push ebx
push edi
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and word [ebx + eax*2], 0
jmp 0x4013a6
lea ecx, [edi + edi + 2]
call section..text
push edi
mov ebx, eax
push ebx
push edi
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [ebx + eax*2], si
jmp 0x4013a6
cmp word [edi], dx
jne 0x4013a6
cmp word [edi + 2], 0x3e
jne 0x4013a6
add esi, 4
cmp edi, esi
mov ecx, edi
mov dword [ebp + 8], ecx
jbe 0x4013a6
jmp 0x401358
mov ecx, dword [ebp + 8]
lea eax, [ecx - 2]
cmp word [eax], dx
jne 0x401367
cmp word [ecx - 4], 0x3c
je 0x401370
cmp eax, esi
mov dword [ebp + 8], eax
ja 0x401355
jmp 0x4013a6
mov eax, edi
sub eax, ecx
sar eax, 1
lea esi, [eax + eax]
lea ecx, [esi + 2]
call section..text
mov ecx, dword [ebp + 8]
cmp ecx, edi
mov ebx, eax
jae 0x4013a2
add esi, ebx
sub ecx, ebx
cmp eax, esi
jae 0x4013a2
mov dx, word [ecx + eax]
mov word [eax], dx
inc eax
inc eax
lea edx, [ecx + eax]
cmp edx, edi
jb 0x40138e
and word [eax], 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, ebx
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x4013b8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00401111
test eax, eax
push 2
mov dword [ebp - 4], eax
pop esi
jne 0x4013e0
mov ecx, esi
call section..text
and word [eax], 0
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.004011eb
mov ebx, eax
test ebx, ebx
mov dword [ebp + 8], ebx
jne 0x401401
mov ecx, esi
call section..text
mov ebx, eax
and word [ebx], 0
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x20
mov edi, eax
pop ecx
jmp 0x401410
add edi, esi
cmp word [edi], cx
je 0x40140e
cmp word [edi], 0x22
jne 0x40142f
add edi, esi
movzx eax, word [edi]
test ax, ax
je 0x401442
add edi, esi
cmp ax, 0x22
jne 0x40141d
jmp 0x401442
movzx eax, word [edi]
test ax, ax
je 0x401442
add edi, esi
cmp ax, cx
jne 0x40142f
jmp 0x401442
add edi, esi
cmp word [edi], cx
je 0x401440
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
push ebx
mov dword [ebp - 8], eax
call esi
mov ecx, dword [ebp - 8]
push dword [ebp - 4]
lea ebx, [ecx + eax]
call esi
mov ecx, dword [ebp + 0xc]
add eax, ebx
lea eax, [eax + ecx + 0x20]
lea ecx, [eax + eax]
call section..text
push edi
push dword [ebp + 8]
mov esi, eax
push dword [ebp - 4]
push str._s__s__s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 4]
add esp, 0x14
call fcn.00401010
mov ecx, dword [ebp + 8]
call fcn.00401010
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x4017aa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jae 0x4017bd
xor eax, eax
jmp 0x4017f3
mov eax, dword [esi + 4]
push edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov edi, 0x10000
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [esi + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4017f6
mov eax, dword [ebp - 4]
test eax, eax
je 0x4017fe
add dword [esi + 0xc], eax
sub edi, eax
jne 0x4017cc
xor eax, eax
pop edi
pop esi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4017f2
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
sbb eax, eax
and eax, 0xffffffda
add eax, 0x26
jmp 0x4017f2

Function at 0x4018e7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
mov edi, dword [esi + 8]
mov dword [esi + 8], eax
jmp 0x40191a
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [esi + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40192a
mov eax, dword [ebp - 4]
test eax, eax
je 0x401932
add dword [esi + 8], eax
sub edi, eax
jne 0x4018fa
mov eax, dword [esi + 4]
mov dword [esi + 8], eax
xor eax, eax
pop edi
pop esi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401926
push 0x27
pop eax
jmp 0x401926
Function at 0x4019e8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
mov esi, ecx
test esi, esi
mov edi, edx
mov dword [ebp - 0xc], edi
je 0x401bae
test edi, edi
je 0x401bae
mov eax, dword [esi + 0x54]
test eax, eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
je 0x401a3b
push dword [ebp + 8]
push 0
push 0x1400
push eax
call ebx
lea eax, [edi + 0x10]
push eax
push 0
push 0x1401
push dword [esi + 0x54]
call ebx
mov eax, dword [esi + 0x58]
test eax, eax
je 0x401a3b
call eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401a56
and eax, 0xfffffffa
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 0x10000
lea ecx, [ebp - 0x2c]
call fcn.0040189e
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x2c], eax
jne 0x401a93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x401ba1
mov ecx, dword [edi + 0x14]
test ecx, ecx
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x1c], 0x401862
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], ecx
ja 0x401b03
test eax, eax
ja 0x401b03
lea eax, [edi + 0x20]
push eax
push 0
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea ecx, [ebp - 0x2c]
call fcn.004018be
test eax, eax
mov dword [ebp - 4], eax
jne 0x401ada
push dword [edi + 0x28]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esi + 0x54]
test eax, eax
je 0x401af7
push dword [ebp - 4]
push 0
push 0x1403
push eax
call ebx
mov esi, dword [esi + 0x58]
test esi, esi
je 0x401af7
call esi
mov eax, dword [ebp - 4]
pop ebx
jmp 0x401bb1
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
sub edi, dword [ebp - 0x24]
xor ecx, ecx
cmp ecx, dword [ebp - 0x10]
jb 0x401b18
ja 0x401b16
cmp edi, eax
jbe 0x401b18
mov edi, eax
sub eax, edi
sbb dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x50]
call fcn.00401f3e
add esp, 0x14
test eax, eax
jne 0x401b88
cmp dword [ebp - 8], edi
jne 0x401b91
add dword [ebp - 0x24], edi
lea ecx, [ebp - 0x2c]
call fcn.004018e7
test eax, eax
mov dword [ebp - 4], eax
jne 0x401ba1
mov eax, dword [esi + 0x54]
test eax, eax
je 0x401b72
push edi
push 0
push 0x1402
push eax
call ebx
mov eax, dword [esi + 0x58]
test eax, eax
je 0x401b72
call eax
test eax, eax
je 0x401b9a
cmp dword [ebp - 0x10], 0
ja 0x401b00
jb 0x401b80
cmp dword [ebp - 0x14], 0
ja 0x401b00
mov edi, dword [ebp - 0xc]
jmp 0x401aae
mov dword [ebp - 4], 0x1e
jmp 0x401ba1
mov dword [ebp - 4], 0x26
jmp 0x401ba1
mov dword [ebp - 4], 0x4c7
lea ecx, [ebp - 0x2c]
call fcn.004018be
jmp 0x401ada
push 0x57
pop eax
pop edi
pop esi
leave
ret 4
Function at 0x896692
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edx
jmp 0x8966dd
mov dword [esp], ebx
jmp 0x896813
pushfd
pop word [esp]
push word [esp + 1]
jp 0x8966c7
mov dword [esp], ebx
pushal
pop dword [esp + 0xd]
jmp 0x8967c1
mov dword [esp + 0x10], esp
call fcn.00896741
mov eax, 0x5885fcf6
mov ch, 0x41
mov bh, cl
jmp 0x896799
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp]
lea ebx, [ebp + 0x26]
cmc
jmp 0x8967e2
mov bl, ch
jmp 0x8967cc
mov word [esp + 2], bx
mov dword [esp + 0x17], eax
jmp 0x896821
lea esi, [esp]
mov bh, 0xfb
sub esp, 0xa
jo 0x8967e8
jno 0x8967f2
push edx
salc
inc esp
and ebx, esi
push 0x58796ec7
jbe 0x8967aa
mov bl, ch
jmp 0x8967cc
mov dh, byte [esp + 3]
jmp 0x89730c
mov dh, byte [esp + 3]
pop word [esp + 3]
jmp 0x897311
pushal
pop dword [esp + 0xd]
mov word [esp + 2], bx
mov dword [esp + 0x17], eax
push dword [esp + 2]
lea esp, [esp + 9]
lea esp, [esp + 3]
jmp 0x896774
rdtsc
lea ecx, reloc.kernel32.dll_RtlMoveMemory
xchg ebx, ecx
jmp 0x896a5f
cmp dx, 0xe17e
jne 0x896f67
lea ecx, reloc.kernel32.dll_RtlMoveMemory
xchg ebx, ecx
rdtsc
jmp fcn.00896a61
pop word [esp + 3]
sub esp, 0xb8
mov edi, esp
jmp 0x8970f3

Function at 0x89671f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0885c64
jmp 0x89677d
lea esp, [esp + 1]
lea esp, [esp + 3]
mov dword [esp + 8], esi
push esp
jmp 0x896724
mov dword [esp], esi
jmp 0x896709
push dword [esp + 2]
jne 0x896756
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x896793
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x896793
pushfd
jmp 0x8948bc

Function at 0x896741
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 1]
mov dword [esp + 0xc], ebp
call fcn.0089671f

Function at 0x8ca58f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov esi, 0xc452a8b9
cmp dword [ebx + 0x63], 0x64751ae3
mov dl, byte [eax]
call fcn.008ca547
js 0x8ca474
and al, 0x54
push ss
invalid
lea esp, [esp + 4]
jne 0x8ca496
je 0x8ca454
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x2d]
dec edx
in eax, 0x8b
push ebp
cld
Function at 0x8ca88c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, 0x132d9668
sub esp, 0xc
jmp 0x8ca8fd
add byte [eax], al
int1
popal
add bl, dh
inc eax
jo 0x8ca6fb
leave
ret 8
test dword [edi - 3], esi
invalid
call fcn.008caa32
daa
dec esi
fnstcw word [eax]
jae 0x8ca6b2
mov ebx, 0x5ea10d06
clc
adc bl, byte [ebx]
jb 0x8ca73d
jl 0x8ca721
call fcn.008caa95
inc ebp
jle 0x8ca67e
mov ebp, 0xd9025c77
insd dword es:[edi], dx
mov cs, word [ecx - 0x63]
jl 0x8ca6bb
inc ecx
ret
pop esi
test eax, 0x24648dc8
add al, 0xff
dec esp
and al, 8
call 0x8ca63c
mov edx, 0x10b
jmp 0x8ca8cc
add eax, ecx
lea edx, [edi + ebp]
bsf edx, ecx
mov dh, cl
setge dh
jmp 0x8ca891
neg ah
neg al
bsf ax, si
jmp 0x8ca92b
cmp word [eax + 0x18], dx
pushfd
lea esp, [esp + 4]
je 0x8ca672
jne 0x8ca8b6
push edi
mov edi, ebp
lea edi, [edi - 0x18]
jmp 0x8ca907
push ebx
mov ebx, esi
jmp 0x8ca948
mov esi, dword [eax + 0x78]
add esi, ecx
mov eax, dword [eax + 0x7c]
jmp 0x8ca8dd
mov dword [edi], eax
pop edi
lea esp, [esp + 0xc]
je 0x8ca6d2
push edx
jmp 0x8ca8e5
xor eax, eax
jmp 0x8ca693
add ebx, 0x20
mov eax, dword [ebx]
pop ebx
pushal
add esp, 0x18
call fcn.008ca932
push edi
mov esi, 0x632aee89
adc byte [ebx + 0x711b7fa], bh
jnp 0x8ca99a
stosb byte es:[edi], al
cmp byte [edi - 0x56], bl
sbb ecx, dword [ebx - 0x1e]
mov dh, ch
and dword [ebp - 0xc], 0
mov edx, esi
rcl dx, 1
jmp 0x8ca8a7
jne 0x8ca6bb
je 0x8ca6d2
add ebx, dword [ebp + reloc.kernel32.dll_RtlMoveMemory]
insb byte es:[edi], dx
jg 0x8ca9d7
int1
lea esp, [esp + 0x10]
test eax, eax
push bp
lea esp, [esp + 2]
jmp 0x8ca97c
push edi
jmp 0x8caa07
mov eax, dword [esi + 0x1c]
add edi, ecx
add eax, ecx
pushal
jmp 0x8caa14
mov edi, ebp
add edi, 0xfffffff0
mov dword [edi], eax
pop edi
jmp 0x8ca9da
push word [esp]
lea esp, [esp + 2]
lea esp, [esp + 0x3c]
dec ebx
jmp 0x8caa51
mov dword [ebp - 8], edi

Function at 0x9d8b03
Capabilities:
Access peb ldr_data
Get number of processors
Packed with generic packer
Parse pe header

Disassembly:
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x9d8f3c
pop word [esp]
mov word [esp], dx
push word [esp]
jmp 0x9d8aed
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x9d8bbb
Function at 0x428b30
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49268b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004850b0
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x428bb2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00482ad7
mov eax, dword [eax]
push 0x4ad204
push eax
call fcn.00474e84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0048533b
test bl, bl
je 0x428bb2
push 0x4ad204
lea ecx, [esp + 0xc]
call fcn.00485717
push 0x4b0d48
lea ecx, [esp + 0xc]
call fcn.00485717
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x428bee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0048533b
jmp 0x428cb9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x428c72
lea edx, [esp + 0x7c]
push 0x4b0d44
push edx
call fcn.00474e84
add esp, 8
test eax, eax
je 0x428c72
lea eax, [esp + 0x7c]
push 0x4b0d40
push eax
call fcn.00474e84
add esp, 8
test eax, eax
je 0x428c72
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x428c02
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0048533b
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4294b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x429512
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x429520
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49270b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4b7f34]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x429658
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x429586
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048533b
xor eax, eax
jmp 0x4296cf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004854c4
push esi
lea ecx, [esp + 0xc]
call fcn.00485753
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4296ad
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push SysReAllocStringLen
call fcn.004294b0
test eax, eax
jne 0x4296ad
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push SysReAllocStringLen
mov ecx, edi
call fcn.004294b0
test eax, eax
jne 0x4296ad
lea eax, [esp + 0x14]
push 0x4b0d5c
push eax
call fcn.00476030
mov esi, eax
add esp, 8
test esi, esi
jne 0x42968c
lea ecx, [esp + 0x14]
push 0x4b0d58
push ecx
call fcn.00475fb0
mov esi, eax
add esp, 8
test esi, esi
jne 0x42968c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x42968f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.00485474
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x42959e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0048533b
xor eax, eax
jmp 0x4296cf
mov byte [esi], 0
push 0x4b0d54
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0048533b
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4