joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402b50
Capabilities:
Access peb ldr_data
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x41b360
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push esi
push edi
mov esi, ecx
mov eax, dword [esp + 0x64]
mov dword [esp + 0x5c], 1
mov eax, dword [eax - 8]
dec eax
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x4220d0
call fcn.00411f5c
push ecx
lea edx, [esp + 0x70]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x6c], 2
call fcn.00411c63
mov ecx, esi
mov byte [esp + 0x68], 1
call fcn.004031d0
test eax, eax
jne 0x402c06
push ecx
lea eax, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00411c63
mov ecx, esi
call fcn.00402970
cmp eax, dword [esp + 0x6c]
ja 0x402c06
lea ecx, [esp + 0x64]
mov byte [esp + 0x5c], 0
call fcn.00411eee
lea ecx, [esp + 0x68]
mov dword [esp + 0x5c], 0xffffffff
call fcn.00411eee
xor eax, eax
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x58
ret 0xc
push ecx
lea edx, [esp + 0x68]
mov ecx, esp
mov dword [esp + 0x70], esp
push edx
call fcn.00411c63
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.00402860
push 1
push ecx
lea edx, [esp + 0x6c]
mov ecx, esp
mov dword [esp + 0x74], esp
push edx
mov byte [esp + 0x68], 3
call fcn.00411c63
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.00402720
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x18]
mov edx, dword [esp + 0x68]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], 5
mov dword [esp + 0x20], 0x40
mov dword [esp + 0x28], str.Open
mov dword [esp + 0x34], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edx, dword [esp + 0x50]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 8]
call fcn.00411eee
lea ecx, [esp + 0xc]
mov byte [esp + 0x5c], 1
call fcn.00411eee
lea ecx, [esp + 0x64]
mov byte [esp + 0x5c], 0
call fcn.00411eee
lea ecx, [esp + 0x68]
mov dword [esp + 0x5c], 0xffffffff
call fcn.00411eee
mov ecx, dword [esp + 0x54]
pop edi
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x58
ret 0xc
Function at 0x402df0
Capabilities:
Get mac address on windows

Disassembly:
push 0xffffffffffffffff
push 0x41b3cf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, ecx
push esi
lea ecx, [esp + 0x18]
push edi
xor eax, eax
push ecx
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
call sub.iphlpapi.dll_GetAdaptersInfo
mov edx, dword [esp + 0x1c]
push edx
call fcn.00411c2f
add esp, 4
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
mov eax, dword [0x4223c8]
mov dword [esp + 0x18], eax
mov ebx, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], eax
lea ecx, [esi + 8]
lea edx, [esp + 0x14]
push ecx
push 0x422124
push edx
mov byte [esp + 0x38], 3
call fcn.00411411
add esp, 0xc
lea eax, [esi + 0x10c]
lea ecx, [esp + 0x10]
push eax
push 0x422124
push ecx
call fcn.00411411
xor edx, edx
add esp, 0xc
mov dl, byte [esi + 0x199]
xor eax, eax
mov al, byte [esi + 0x198]
xor ecx, ecx
mov cl, byte [esi + 0x197]
push edx
push eax
xor edx, edx
mov dl, byte [esi + 0x196]
push ecx
xor eax, eax
xor ecx, ecx
mov al, byte [esi + 0x195]
mov cl, byte [esi + 0x194]
push edx
push eax
push ecx
lea edx, [esp + 0x30]
push str._02X_02X_02X_02X_02X_02X
push edx
call fcn.00411411
mov eax, dword [esp + 0x58]
mov edi, dword [esi]
add esp, 0x20
test eax, eax
je 0x402f5c
test edi, edi
je 0x402f5c
lea eax, [edi + 8]
lea ecx, [esp + 0x14]
push eax
push 0x422124
push ecx
call fcn.00411411
add esp, 0xc
lea edx, [edi + 0x10c]
lea eax, [esp + 0x10]
push edx
push 0x422124
push eax
call fcn.00411411
xor ecx, ecx
add esp, 0xc
mov cl, byte [edi + 0x199]
xor edx, edx
mov dl, byte [edi + 0x198]
xor eax, eax
mov al, byte [edi + 0x197]
push ecx
push edx
xor ecx, ecx
mov cl, byte [edi + 0x196]
push eax
xor edx, edx
xor eax, eax
mov dl, byte [edi + 0x195]
mov al, byte [edi + 0x194]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push str._02X_02X_02X_02X_02X_02X
push ecx
call fcn.00411411
mov edi, dword [edi]
add esp, 0x20
jmp 0x402edd
push esi
call fcn.00411c58
mov eax, dword [esp + 0x40]
add esp, 4
cmp eax, ebx
jne 0x402f90
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.00411c63
mov esi, dword [esp + 0x38]
mov ecx, ebp
push esi
call fcn.004036d0
mov dword [esp + 0x20], ebx
jmp 0x402fc8
cmp eax, 2
jne 0x402fb4
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00411c63
mov esi, dword [esp + 0x38]
mov ecx, ebp
push esi
call fcn.004036d0
jmp 0x402fc4
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.00411c63
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.00411eee
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], bl
call fcn.00411eee
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 0
call fcn.00411eee
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0xc
Function at 0x4039d0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x41b5e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x150
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x1c], 0
mov edi, 1
mov dword [esp + 0x168], edi
mov eax, dword [0x4223c8]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x174]
push 0x4220d0
lea edx, [esp + 0x1c]
push ecx
push edx
mov byte [esp + 0x174], 3
call fcn.00412137
lea ecx, [esp + 0x178]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
mov byte [esp + 0x174], 4
call fcn.004120d1
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00411eee
lea ecx, [esp + 0x18]
mov byte [esp + 0x168], 3
call fcn.00411eee
cmp esi, 0xffffffff
jne 0x403a93
mov esi, dword [esp + 0x170]
push 0x425a60
mov ecx, esi
call fcn.00411f5c
mov dword [esp + 0x1c], edi
jmp 0x403bf0
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [esp + 0x17c]
test eax, eax
jne 0x403abf
mov edx, dword [esp + 0x20]
and edx, 0x10
cmp dl, 0x10
jne 0x403b25
lea eax, [esp + 0x20]
push eax
push esi
call ebp
mov edi, eax
jmp 0x403b73
mov ecx, dword [esp + 0x20]
and ecx, 0x10
cmp cl, 0x10
je 0x403ada
lea edx, [esp + 0x20]
push edx
push esi
call ebp
mov edi, eax
jmp 0x403b73
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x10]
push eax
call fcn.00411f5c
mov ecx, dword [esp + 0x10]
push 0x422144
push ecx
call fcn.004061ea
add esp, 8
test eax, eax
je 0x403b58
mov edx, dword [esp + 0x10]
push 0x422140
push edx
call fcn.004061ea
add esp, 8
test eax, eax
je 0x403b58
lea ecx, [esp + 0x10]
mov byte [esp + 0x168], 3
call fcn.00411eee
mov eax, dword [esp + 0x180]
push 1
push eax
push ecx
lea edx, [esp + 0x58]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00411f5c
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call fcn.004038d0
lea ecx, [esp + 0x20]
push ecx
push esi
call ebp
mov edi, eax
jmp 0x403b73
lea edx, [esp + 0x20]
push edx
push esi
call ebp
lea ecx, [esp + 0x10]
mov edi, eax
mov byte [esp + 0x168], 3
call fcn.00411eee
test edi, edi
jne 0x403a99
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x184]
test eax, eax
je 0x403bd5
mov eax, dword [esp + 0x180]
lea edx, [esp + 0x14]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.00411c63
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call fcn.00403520
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x16c], 6
call fcn.00411fdb
lea ecx, [esp + 0x18]
mov byte [esp + 0x168], 3
call fcn.00411eee
mov esi, dword [esp + 0x170]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.00411c63
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x168], 2
call fcn.00411eee
lea ecx, [esp + 0x174]
mov byte [esp + 0x168], 1
call fcn.00411eee
lea ecx, [esp + 0x178]
mov byte [esp + 0x168], 0
call fcn.00411eee
mov ecx, dword [esp + 0x160]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x15c
ret 0x18
Function at 0x403d10
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41b628
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x28]
xor esi, esi
mov dword [esp + 0x20], esi
cmp dword [eax - 8], esi
je 0x403de7
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.00411c63
mov ecx, ebp
call fcn.00401e50
cmp eax, esi
je 0x403de7
mov edi, dword [esp + 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, esi
mov dword [esp + 0x14], esi
jle 0x403da2
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x28]
push eax
call ebp
test eax, eax
jne 0x403d96
push 0x1f4
call ebx
inc esi
cmp esi, edi
jl 0x403d7d
jmp 0x403d9e
mov dword [esp + 0x14], 1
mov ebp, dword [esp + 0x10]
xor esi, esi
test edi, edi
jle 0x403dd0
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.00411c63
mov ecx, ebp
call fcn.00401e50
test eax, eax
je 0x403dd0
push 0x1f4
call ebx
inc esi
cmp esi, edi
jl 0x403da8
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.00411eee
mov eax, dword [esp + 0x14]
jmp 0x403dfa
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.00411eee
xor eax, eax
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 8
Function at 0x403e10
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x41b650
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x28]
xor esi, esi
mov dword [esp + 0x20], 1
cmp dword [eax - 8], esi
je 0x403f2c
mov ecx, dword [esp + 0x2c]
cmp dword [ecx - 8], esi
je 0x403f2c
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.00411c63
mov ecx, ebp
call fcn.00401e50
cmp eax, esi
je 0x403f2c
mov edi, dword [esp + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, esi
mov dword [esp + 0x14], esi
jle 0x403eb7
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x403eaf
push 0x1f4
call ebx
inc esi
cmp esi, edi
jl 0x403e88
jmp 0x403eb7
mov dword [esp + 0x14], 1
xor esi, esi
test edi, edi
jle 0x403f07
jmp 0x403ec3
mov ebp, dword [esp + 0x10]
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00411c63
mov ecx, ebp
call fcn.00402970
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
mov ebp, eax
call fcn.00411c63
mov ecx, dword [esp + 0x14]
call fcn.00402970
cmp ebp, eax
je 0x403f07
push 0x1f4
call ebx
inc esi
cmp esi, edi
jl 0x403ebf
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 0
call fcn.00411eee
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call fcn.00411eee
mov eax, dword [esp + 0x14]
jmp 0x403f4d
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 0
call fcn.00411eee
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call fcn.00411eee
xor eax, eax
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 0x10
Function at 0x404350
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41b747
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esp + 0xc]
push 0
mov ecx, dword [esi + 0xc0]
push eax
mov dword [esp + 0x28], 0
call fcn.00401b50
mov ebx, 1
push 0
push 0x5c
push ebx
push ecx
mov dword [esp + 0x40], ebx
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x422218
call fcn.00411f5c
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x48], 2
call fcn.00411c63
mov ecx, dword [esi + 0xc0]
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x48], bl
call fcn.004039d0
push 0x4220d0
push 0
push 0x5c
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x44], 3
call fcn.00411c63
mov ecx, dword [esi + 0xc0]
lea eax, [esp + 0x2c]
push eax
call fcn.00402d00
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov byte [esp + 0x40], 4
call fcn.004120d1
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x3c], 5
call fcn.00412137
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 6
call fcn.00411fdb
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 5
call fcn.00411eee
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 4
call fcn.00411eee
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 3
call fcn.00411eee
push ebx
push 0
push 0
push ebx
mov ecx, dword [esi + 0xc0]
push 0
call fcn.004038a0
lea ecx, [esp + 0x30]
push eax
push ecx
mov ecx, dword [esi + 0xc0]
call fcn.00403770
mov edi, eax
mov ecx, dword [esi + 0xc0]
push 0
push ebx
push 0
push 7
push 5
mov byte [esp + 0x44], 7
call fcn.004038a0
mov ecx, dword [esi + 0xc0]
lea edx, [esp + 0x20]
push eax
push edx
call fcn.00403770
push eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x3c], 8
call fcn.004120d1
push edi
lea edx, [esp + 0x20]
push eax
push edx
mov byte [esp + 0x3c], 9
call fcn.004120d1
mov esi, dword [esp + 0x38]
push str..exe
push eax
push esi
mov byte [esp + 0x3c], 0xa
call fcn.00412137
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 9
call fcn.00411eee
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 8
call fcn.00411eee
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 7
call fcn.00411eee
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 3
call fcn.00411eee
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call fcn.00411eee
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.00411eee
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret 4
Function at 0x404560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41b77f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x4223c8]
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], 1
cmp eax, 6
ja case.default.0x40459e
jmp dword [eax*4 + 0x404630]
push str.6c78787429374529364a29364a6873737174373272697829364a756670736b29364a
jmp 0x4045d4
push str.57534a585b455649293947293947516d67767377736a782939472939475b6d7268737b77293947293947477976766972785a6976776d7372293947293947567972
jmp 0x4045d4
push str.4568736669
jmp 0x4045d4
push str.67636d726d7832746c7429374a74636d682937487374697229363a716567293748
jmp 0x4045d4
push str.67637065777832746c7429374a74636d682937487374697229363a716567293748
jmp 0x4045d4
push str.67637374697232746c74
jmp 0x4045d4
push str.7374697232746c7429374a71293748
lea ecx, [esp + 0xc]
call fcn.0041202b
push 4
push 1
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.00411c63
mov esi, dword [esp + 0x2c]
mov ecx, dword [edi + 0xc4]
push esi
call fcn.00401170
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.00411eee
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 8

Function at 0x4107e1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x410801
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00407787
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x410824
test byte [esp + 8], 2
je 0x410824
call fcn.004077fa
mov dword [eax], 0xd
call fcn.00407803
mov dword [eax], 5
jmp 0x4107fd
xor eax, eax
ret

Function at 0x418540
Capabilities:
Create http request

Disassembly:
mov eax, 0x41b9e8
call fcn.00406ce8
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x418578
call fcn.0041a4ca
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x41859d
push eax
push dword [esi + 4]
call fcn.0041919c
jmp 0x4185a9
push esi
push eax
mov ecx, 0x425d10
call fcn.004185ba
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x41886b
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x41ba47
call fcn.00406ce8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00413e46
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x4223c8]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.0041202b
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.0041202b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x41a03e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41a06c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41a08a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00419fa4
jmp 0x41a08a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41a08a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00419fa4
test edi, edi
mov eax, edi
jne 0x41a074
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1000a205
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x1000a227
mov eax, 0xfffffffd
jmp 0x1000a304
mov ebx, dword [0x100374db]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x1000a2d2
mov ebx, dword [0x100374db]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x1000a276
mov ebx, dword [0x100374db]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x1000a276
mov eax, 1
jmp 0x1000a278
xor eax, eax
test eax, eax
je 0x1000a2a4
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x1000a28d
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x100374db]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x1000a2fa
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x1000a304
mov esp, ebp
pop ebp
ret 4
Function at 0x10029226
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x18], edx
bsf edi, eax
jmp fcn.10044e6c

Function at 0x1002d8f7
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, dword fs:[0x30]
mov al, byte [ecx + 2]
leave
ret

Function at 0x10063d21
Capabilities:
Encode data using xor

Disassembly:
pushfd
lea eax, [eax - 0x4086f298]
pushfd
lea esp, [esp + 0x28]
jbe 0x100bfb8d
xchg dword [esp], eax
pushal
pushfd
push dword [esp + 0x24]
ret 0x28
call fcn.100e7ba3

Function at 0x1009bc2f
Capabilities:
Packed with generic packer

Disassembly:
call fcn.101444d4
les esp, [eax - 0x2115a09d]
insd dword es:[edi], dx
popal
in al, 0xa7
push cs
cli
jno 0x1009bc6f
add byte [ebx - 0x370ba276], ch
imul esi, dword [esi], 0xfffffff1
int 0x88
and ecx, dword [esi + 0x147b3861]
cmpsd dword [esi], dword es:[edi]
sub edi, dword [eax]
jmp 0x1009bcd6
mov esi, 0x6afaf81
sub dword [edi - 0x1f64f951], 0xeefa737f
push es
wait
loopne 0x1009bcf5
jae 0x1009bc72
out dx, al
imul esp, esp, 0x3d94217a
test al, 0x47
sub dl, byte [ebp - 0xba43bf0]
out dx, eax
daa
and ecx, dword [esi - 0x2e158474]
or byte [ecx], ch
sbb bh, byte [ebp + 0x16]
adc dword [0x39a51ab3], edx
jo 0x1009bca2
lodsd eax, dword [esi]
or al, 0xf5
je 0x1009bcb0
lcall 0x8c31, 0x7d582129
mov word [ebx], fs
mov esp, 0xfe57d013
jnp 0x1009bd20
sub dword [ecx], esp
pop eax
jge 0x1009bcd8
mov word [ebx + 0x57d013bc], cs
adc edx, eax
push edi
invalid
outsd dx, dword [esi]
fisub dword [ebp - 0x1f]
cmp dh, bh
jne 0x1009bcab
mov dl, 0xf9
xchg edx, eax
lea edx, [ecx + 0x2fbcbe27]
xchg esi, eax
jbe 0x1009bcc5
jl 0x1009bc6e
test al, 0xf
test al, 0xa3
cmpsd dword [esi], dword es:[edi]
pop ebp
int3
push gs
mov dword [0xbacc5da7], eax
shr dword ss:[ebp + 0x24a97314], 0x12
mov fs, ebp
xchg ebx, eax
in eax, 0x93
and cl, cl
and eax, 0x2f53c4e0
xchg esi, eax
test al, 0x1f
xchg esi, eax
sbb eax, 0x369ff8a6
iretd
and al, 0x86
rcr dword [eax - 0x13], 1
movsd dword es:[edi], dword [esi]
test eax, 0xfd5dd267
inc esp
or al, 0xb7
push ds
pop ss
mov ss, word [0xea67d1cd]
xchg ebx, eax
push ss
mov ebp, 0xcd0ceb74
std
popfd
inc esp
sti
jb 0x1009bce0
mov bh, 0x16
and byte [ecx - 0x4d], 0xd5
insb byte es:[edi], dx
fcmovnu st(0), st(1)
mov al, byte [0xe16aef13]
mov word [ebx], ss
cli
jl 0x1009bd46
xchg esp, eax
lea edi, [edi + eax*8]
adc ebp, dword [edx + 0x5eebf748]
cmp al, 3
xor bl, ah
pop eax
invalid
in al, dx
lea ecx, [edi]
sub eax, 0x16af20a5
nop
xor byte [esi + 0x51927684], bl
invalid

Function at 0x100fc7f8
Capabilities:
Packed with generic packer

Disassembly:
movsx ecx, dl
jmp 0x10088715
mov ecx, 0x10029496
call fcn.1006b4eb
mov dword [esp + 0x30], ecx
movsx cx, dl
jmp 0x1006c1bf

Function at 0x100fe195
Capabilities:
Encode data using xor

Disassembly:
push 0xcddb3b34
call fcn.10100dbd
xchg dword [esp + 0x4c], edi
movsx di, dl
not di
lea esp, [esp + 0x4c]
jb 0x100e599e
mov edi, 0x10005333
jmp 0x100cac99