joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f7912e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_ThkMgrUninitialize___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.ThkMgrUninitialize
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f791340
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TransformHRESULT_1632___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.TransformHRESULT_1632
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f7913a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TransformHRESULT_3216___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.TransformHRESULT_3216
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f791400
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_ConvertObjDescriptor___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.ConvertObjDescriptor
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f791460
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_ConvertHr1632Thunk___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.ConvertHr1632Thunk
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f7914c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_ConvertHr3216Thunk___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.ConvertHr3216Thunk
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6f791520
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_IntOpUninitialize___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.IntOpUninitialize
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f791580
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_ThkAddAppCompatFlag___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x6f795090
mov dword [ebp - 0x40], str.ThkAddAppCompatFlag
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6f793270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp + 0xc]
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x6f795504
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_vfprintf]
call sym._abort
lea esi, [esi]
Function at 0x401005
Capabilities:
Access peb ldr_data

Disassembly:
push 0
push 2
push 0x403071
push 0x403053
call dword [sym.imp.Winmm.dll_mciSendStringA]
cmp eax, 0x107
je 0x401021
ret
mov edi, edi
mov esi, 0x402058
mov edi, esi
push 1
push 0x40308f
push 1
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreW]
mov edx, eax
pop ebx
mov ecx, 0x340
mov al, byte [esi]
sub al, bl
stosb byte es:[edi], al
inc esi
loop 0x401045
push dword fs:[0x30]
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
cmp word [eax], 0x5a4d
je 0x40106b
xor eax, eax
mov dword [0x4030a2], eax
add esp, 4
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10008277
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x1000c383
call fcn.1000b72f
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1000844b
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.1000b227
add esp, 0xc
test eax, eax
js 0x10008445
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x10008313
push esi
call fcn.10004bbf
pop ecx
test al, al
je 0x10008313
mov eax, esi
call fcn.1000ba01
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000831f
push esi
lea ecx, [ebp - 0x428]
call fcn.1000b227
push 3
push esi
push edi
push eax
call fcn.1000b227
test eax, eax
je 0x10008445
push 2
push ebx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
mov dword [ebp - 0x41c], edi
test edi, edi
jne 0x10008353
call fcn.10004ded
mov esi, eax
jmp 0x1000842a
push dword [ebp - 0x424]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x10008376
call fcn.10004ded
jmp 0x10008421
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x1000836c
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x420], esi
cmp eax, esi
jae 0x100083a6
mov esi, 0x8007000e
jmp 0x10008423
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000b227
mov dword [ebp - 4], 1
jmp 0x100083e5
cmp dword [ebp - 0x418], 0
je 0x1000839f
push esi
push dword [ebp - 0x424]
push esi
push dword [ebp - 0x418]
call fcn.1000b227
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.1000b227
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10008465
lea ecx, [ebp - 0x418]
call fcn.100084ce
jmp 0x10008465
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x10008460
lea ecx, [ebp - 0x418]
call fcn.100084ce
mov esi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.10004d27
mov eax, esi
lea esp, [ebp - 0x444]
call fcn.1000b788
ret 0x10
Function at 0x1000a997
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10001fc0]
jne 0x1000b8a4
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1000ee40], eax
mov dword [0x1000ee3c], ecx
mov dword [0x1000ee38], edx
mov dword [0x1000ee34], ebx
mov dword [0x1000ee30], esi
mov dword [0x1000ee2c], edi
mov word [0x1000ee58], ss
mov word [0x1000ee4c], cs
mov word [0x1000ee28], ds
mov word [0x1000ee24], es
mov word [0x1000ee20], fs
mov word [0x1000ee1c], gs
pushfd
pop dword [0x1000ee50]
mov eax, dword [ebp]
mov dword [0x1000ee44], eax
mov eax, dword [ebp + 4]
mov dword [0x1000ee48], eax
lea eax, [ebp + 8]
mov dword [0x1000ee54], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1000ed90], 0x10001
mov eax, dword [0x1000ee48]
mov dword [0x1000ed44], eax
mov dword [0x1000ed38], 0xc0000409
mov dword [0x1000ed3c], 1
mov eax, dword [0x10001fc0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1000ea64]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1000ed88], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100021c0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1000ed88], 0
jne 0x1000b990
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x1000b227
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000b236
pop dword [ebp - 0x10]
mov eax, 0xfde352f1
sub eax, 0xede2a0bb
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xa51f0e96
sub dword [ebp - 0x20], 0x56ccc94b
mov dword [ebp - 0x1c], 0x5436238f
sub dword [ebp - 0x1c], 0x2202d74a
mov dword [ebp - 0x18], 0xc61b7ccf
sub dword [ebp - 0x18], 0x79cf38a1
mov dword [ebp - 0x14], 0x557909fe
sub dword [ebp - 0x14], 0x557909fe
lea eax, [ebp - 0x20]
push eax
mov eax, 0x4602cdd4
add eax, 0xc9fd4288
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xe5a5307d
add dword [ebp - 0x20], 0x8ecd38d9
mov dword [ebp - 0x1c], 0xc9f79b20
add dword [ebp - 0x1c], 0x7774c655
mov dword [ebp - 0x18], 0x3177d660
add dword [ebp - 0x18], 0x31f7960c
mov dword [ebp - 0x14], 0x23706612
add dword [ebp - 0x14], 0xdc8f99ee
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x73f89684
sub eax, 0x63f8862c
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3ba5f
push 0
call eax
mov ecx, 0x55dc
xor edx, edx
add edx, eax
mov edi, 0x10013000
add edi, dword [ebp - 0x10]
mov esi, 0xb75f17b9
add esi, 0xf53c9106
mov ebx, dword [edi]
add dword [ebp - 0xc], ecx
sub ebx, esi
xor dword [ebp - 8], 0xfab15f40
mov dword [edx], ebx
xor dword [ebp - 0xc], ebx
add edx, 0xa0400f25
sub edx, 0xa0400f21
add edi, 0xc848eb9b
sub edi, 0xc848eb97
loop 0x1000b34e
add eax, 0x14a43
mov ebx, eax
add eax, 0x9aec1fd9
add eax, 0x6513e02c
mov ecx, 0xcf827cde
sub ecx, 0xbf827cde
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x100100b7
Capabilities:
Get thread local storage value

Disassembly:
push 8
mov eax, 0x1005827c
call fcn.10025a34
cmp byte [0x10093bd8], 0
push dword [0x10093bd4]
je 0x100100da
call dword [sym.imp.kernel32.dll_FlsGetValue]
jmp 0x100100e0
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10010128
push 0x14
call fcn.10025fdc
mov esi, eax
pop ecx
test esi, esi
je 0x10010130
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 4], edi
push 8
pop ecx
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call fcn.10002cc8
mov dword [esi], eax
push esi
mov dword [eax], edi
mov dword [eax + 4], edi
mov ecx, dword [esi]
mov dword [ecx], esi
mov ecx, 0x10093bd4
call fcn.10025fdc
mov eax, esi
call fcn.10025a05
ret
call fcn.10025fdc
int3

Function at 0x10025fdc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10025feb
pop dword [ebp - 0x14]
mov eax, 0xeb96550e
sub eax, 0xdb93f523
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x4c02e
push 0
mov eax, 0x71bb3748
sub eax, 0x61b584f0
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x3d34
mov esi, eax
mov edi, 0xb89211ff
sub edi, 0xa8881fff
add edi, dword [ebp - 0x14]
mov ebx, 0x3c5a5709
add ebx, 0xa129d4b0
xor dword [ebp - 4], 0x5886f0c7
mov edx, dword [edi]
add dword [ebp - 0xc], edx
xor edx, ebx
xor dword [ebp - 0x10], edi
mov dword [esi], edx
xor dword [ebp - 8], 0xd5451e2b
add esi, 0x1743ac37
sub esi, 0x1743ac33
add edi, 0x54874884
sub edi, 0x54874880
loop 0x10026044
add eax, 0xe7a3
xor ebx, ebx
add ebx, eax
add eax, 0x143b80bc
sub eax, 0x143b80b7
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x1000a6a4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10011dac], 0
push esi
push edi
jne 0x1000a61a
call fcn.1000a586
test eax, eax
je 0x1000a65f
mov eax, dword [0x10011dac]
cmp eax, 1
jne 0x1000a63b
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1000a65f
jmp 0x1000a6a1
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1000a6a1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000a663
xor eax, eax
jmp 0x1000a6a1
mov eax, dword [esi]
push dword [0x10011dac]
call edi
mov edi, eax
test edi, edi
je 0x1000a685
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1000a6a1
lea edi, [esi + 0xff0]
push esi
push dword [0x10011dac]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1000a68b
mov eax, esi
pop edi
pop esi
ret
jmp 0x1000a606

Function at 0x1000a812
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10011c4c]
jne 0x1000a81c
repz ret
jmp fcn.1000b021

Function at 0x1000acde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000aced
pop dword [ebp - 0xc]
mov eax, 0xedf79246
add eax, 0x22091aa7
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x32b3f
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x3606
mov esi, eax
mov edi, 0x6b59b1bb
sub edi, 0x5b57ebbb
add edi, dword [ebp - 0xc]
mov edx, 0x1cbbfeb
add dword [ebp - 4], 0x3ce6920c
mov ebx, dword [edi]
add dword [ebp - 4], edi
xor ebx, edx
add dword [ebp - 4], edx
mov dword [esi], ebx
sub dword [ebp - 8], 0xe03c9133
add esi, 0xcc34ae9b
add esi, 0x33cb5169
add edi, 0xc8b44c9e
sub edi, 0xc8b44c9a
loop 0x1000ad3b
add eax, 0xcaeb
mov ebx, eax
add eax, 0x34479848
add eax, 0xcbb867bd
mov ecx, 0x5197449c
add ecx, 0xbe68bb64
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1001f870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1001f87f
pop dword [ebp - 0x34]
mov eax, 0x17ec9931
sub eax, 0x7eaa0b2
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x4254d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0xf25d7e79
sub ecx, 0xf25d2edd
mov esi, eax
mov edx, 0x1003be00
add edx, dword [ebp - 0x34]
mov edi, 0xcc31d970
sub dword [ebp - 0x10], 0x424af00
mov ebx, dword [edx]
xor ebx, edi
xor dword [ebp - 0x30], 0x22281da
mov dword [esi], ebx
xor dword [ebp - 0xc], edx
add esi, 4
add edx, 0xaa404302
sub edx, 0xaa4042fe
loop 0x1001f8cd
add eax, 0x31908888
add eax, 0xce70a8bb
mov ebx, eax
add eax, 0x587928f3
add eax, 0xa786d712
mov ecx, 0xcaefddce
add ecx, 0x45102232
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001f870
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001f870
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x412d80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UzBUtnck
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x412da2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412da9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412d98
mov eax, 1
add ebx, ebx
jne 0x412dbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412db0
jne 0x412dcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412db0
xor ecx, ecx
sub eax, 3
jb 0x412de0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x412e52
mov ebp, eax
add ebx, ebx
jne 0x412deb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x412df8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x412e1c
inc ecx
add ebx, ebx
jne 0x412e08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x412dfd
jne 0x412e19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412dfd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x412e3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x412e2d
jmp 0x412d9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x412e3c
add edi, ecx
jmp 0x412d9e
pop esi
mov edi, esi
mov ecx, 0x2ad
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x412e5a
cmp byte [edi], 0
jne 0x412e5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x412e5f
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x412ece
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x120b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1211c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x412e8c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12124]
or eax, eax
je 0x412ec8
mov dword [ebx], eax
add ebx, 4
jmp 0x412ea9
call dword [esi + 0x12120]
mov ebp, dword [esi + 0x12128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x412f02
sub esp, 0xffffff80
jmp 0x406f9c

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x4ae9b0
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 0xc], 0
jne 0x4ae9bf
lea eax, [esp + 8]
mov dword [esp + 0xc], eax
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
lea ecx, [esp + 0xc]
push ecx
push 0
push edx
push eax
push 0
push 0
call fcn.00547f40
add esp, 0x18
ret 0xc

Function at 0x4b0910
Capabilities:
Create thread

Disassembly:
cmp dword [0x595038], 0
je 0x4b0926
push str.create_thread_n
call fcn.0048e370
add esp, 4
push ebx
push esi
push edi
push 0x595ce0
call dword [0x54e22c]
mov esi, dword [0x5950d8]
test esi, esi
je 0x4b09a1
cmp esi, dword [0x5950dc]
mov eax, dword [esi]
mov dword [0x5950d8], eax
jne 0x4b0958
mov ecx, dword [esi + 4]
mov dword [0x5950dc], ecx
jmp 0x4b0960
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
push 0x595ce0
call dword [0x54e234]
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [0x54e21c]
mov edx, dword [esi + 0x18]
push edx
call dword [0x54e1fc]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push edx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
call dword [0x54e238]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
push 0x595ce0
call dword [0x54e234]
mov eax, dword [0x5950e0]
push eax
push str.new_thread___d__n
push 0xff00ffff
call fcn.0048e390
add esp, 0xc
push 0x1c
call fcn.004a3070
mov esi, eax
mov ebx, dword [esp + 0x10]
mov dword [esi + 0xc], ebx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x10], ecx
push 0
push 0
push 1
push 0
mov edi, dword [0x594c08]
call edi
test eax, eax
jne 0x4b0a0f
call dword [0x54e248]
push eax
push str.failed_to_create_event__d
push str.os_event_create
push 0x1acf
push str.._srcos.c
call fcn.0048e520
push 0
push 0
push 1
push 0
mov dword [esi + 0x14], eax
call edi
test eax, eax
je 0x4b09ef
mov dword [esi + 0x18], eax
add dword [0x5950e0], 1
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x4b0880
lea edx, [esp + 0x24]
push 0
push 0
mov dword [esp + 0x28], edx
call fcn.00547f40
add esp, 0x18
test eax, eax
mov dword [esi + 8], eax
jne 0x4b0999
push ebx
call dword [0x54e248]
push eax
push str.failed_to_create_thread__d:__p
push str.os_thread_create
push 0x1a7e
push str.._srcos.c
call fcn.0048e520
int3