joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100aa0b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10143118]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x100aa0fd
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x100aa0fd
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x100aa0fd
mov edx, dword [ebp + 8]
cmp dword [eax], edx
je 0x100aa10d
add eax, 4
cmp eax, ecx
jb 0x100aa0f2
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d92f9
mov esp, ebp
pop ebp
ret
mov cl, byte [ebp + 0x1c]
test cl, cl
je 0x100aa11d
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], cl
jmp 0x100aa123
mov word [ebp - 0xc], 0x15ff
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0xa], eax
je 0x100aa18a
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x14]
add edi, 0xfffffffa
cmp edi, ebx
jb 0x100aa175
mov esi, edi
lea eax, [ebp - 0xc]
sub esi, eax
xor eax, eax
lea ecx, [ebp - 0xc]
add ecx, eax
mov dl, byte [ecx]
cmp dl, byte [esi + ecx]
je 0x100aa156
cmp dl, 0x11
jne 0x100aa16f
inc eax
cmp eax, 6
jl 0x100aa145
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d92f9
mov esp, ebp
pop ebp
ret
dec edi
dec esi
cmp edi, ebx
jae 0x100aa143
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d92f9
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
push 6
push eax
call fcn.100aa9e0
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
call fcn.100d92f9
mov esp, ebp
pop ebp
ret

Function at 0x100aa1b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10143118]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, 0x5a4d
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], esi
cmp ax, word [edx]
jne 0x100aa20b
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x100aa20b
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x100aa20b
mov edx, dword [ebp + 0xc]
nop dword [eax]
cmp dword [eax], edx
je 0x100aa230
add eax, 4
cmp eax, ecx
jb 0x100aa200
mov dword [esi], 0
mov eax, esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d92f9
mov esp, ebp
pop ebp
ret
mov cl, byte [ebp + 0x20]
test cl, cl
je 0x100aa240
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], cl
jmp 0x100aa246
mov word [ebp - 0xc], 0x15ff
push dword [ebp + 0x18]
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 6
push eax
push esi
call fcn.100a9bf0
mov ecx, dword [ebp - 4]
add esp, 0x18
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100d92f9
mov esp, ebp
pop ebp
ret
Function at 0x100aaac0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.100aaa10
add esp, 0x18
test eax, eax
je 0x100aaae9
inc eax
cmp byte [eax], 0xcc
je 0x100aaae3
pop ebp
ret

Function at 0x100aacf0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.100aac30
add esp, 0x18
test eax, eax
je 0x100aad19
inc eax
cmp byte [eax], 0xcc
je 0x100aad13
pop ebp
ret

Function at 0x100c4ed5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100fa402
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100fa0c2

Function at 0x438cb2
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
add ecx, ecx
sub ecx, 0x22f0bfe6
call fcn.00438ce8
sub eax, eax
or eax, eax
add ecx, eax
xor dword [edi], edx
mov eax, ecx
add eax, 0xc1f7bb7d
add edi, 1
or ecx, ecx
sub ecx, ecx
cmp edi, ebx
jne fcn.00438cb2
add ecx, eax
ret
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x1058f80c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x106098b0]
jne 0x1058f816
repz ret
jmp fcn.1058fabd

Function at 0x1058fed0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.1058fed0]
mov ecx, dword [0x10609884]
sub ecx, 0xaa7
mov dword [0x10609884], ecx
mov dword [ebp - 8], eax
mov eax, dword [0x10609888]
add eax, 0x26d2
mov dword [0x10609884], eax
jmp 0x1058ff1f
mov al, 1
test al, 1
jne 0x1058ff1f
jmp 0x1058ff0a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1058ff4e
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 8]
cmp dword [edx + ecx], 0x4550
jne 0x1058ff4c
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x1058ff11
jmp 0x1058ff4e
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
mov eax, dword [0x10609884]
sub eax, 0x136a
mov dword [0x10609884], eax
jmp 0x1058ff02
Function at 0x105901d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10609888]
sub eax, 0x940
mov dword [0x10609888], eax
mov dword [ebp - 8], 0
mov dword [0x10609884], 0x1950
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [0x10609884], 0x1e00
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [0x10609888]
sub eax, 0x491
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [0x10609888], eax
mov dword [ebp - 0x10], 0
jmp 0x10590299
jmp 0x105902c3
mov dword [0x10609888], 0x26ae
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax - 0xe]
cmp ecx, 0x6c
je 0x1059028d
jmp 0x1059038e
mov eax, dword [0x10609888]
sub eax, 0xeef
mov dword [0x10609884], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
je 0x105902d6
jmp 0x1059039a
mov dword [ebp - 4], 1
jmp 0x105903a1
cmp dword [ebp - 0x10], 0x104
jge 0x10590267
mov dword [0x10609884], 0x1ab8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
jne 0x10590236
jmp 0x10590267
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x10590299
mov dword [0x10609884], 0x125d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
movzx edx, word [eax + ecx*2 - 0x18]
cmp edx, 0x6f
jne 0x10590398
mov dword [0x10609884], 0x1a97
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
movzx edx, word [eax + ecx*2 - 0x16]
cmp edx, 0x61
jne 0x10590396
mov eax, dword [0x10609884]
sub eax, 0x1403
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [0x10609888], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
movzx ecx, word [ecx + edx*2 - 0x14]
cmp ecx, 0x64
jne 0x10590394
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x34]
movzx eax, word [ecx + eax*2 - 0x12]
cmp eax, 0x64
jne 0x10590392
mov dword [0x10609888], 0x2262
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
je 0x1059023b
jmp 0x10590390
jmp 0x10590390
jmp 0x10590392
jmp 0x10590394
jmp 0x10590396
jmp 0x10590398
jmp 0x1059039a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 0x34
pop ebp
ret
Function at 0x105909b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [0x10609888], 0xdfc
mov dword [0x1060988c], 0
mov dword [0x10609890], 0
mov dword [0x1060989c], 0
mov dword [ebp - 0x20], 0
mov dword [0x10609888], 0x2542
mov dword [ebp - 0x24], 0
mov dword [0x10609884], 0x98b
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x10]
jae 0x10590ba5
mov eax, 0x100
mov dword [0x10609888], 0x189c
mov ecx, dword [0x1060988c]
add ecx, 1
mov dword [ebp - 0x28], eax
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x28]
idiv ecx
mov dword [0x1060988c], edx
mov dword [0x10609884], 0xe08
mov edx, dword [0x10609890]
mov esi, dword [0x1060988c]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x10609890], edx
mov dword [0x10609888], 0xbbe
mov edx, dword [0x1060988c]
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + edx]
mov byte [0x10609894], bl
mov dword [0x10609884], 0xcff
mov edx, dword [0x10609890]
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + edx]
mov edx, dword [0x1060988c]
mov esi, dword [ebp - 0x1c]
mov byte [esi + edx], bl
mov dword [0x10609884], 0x1da2
mov edx, dword [0x10609884]
add edx, 0x1b50
mov dword [0x10609888], edx
mov bl, byte [0x10609894]
mov edx, dword [0x10609890]
mov esi, dword [ebp - 0x1c]
mov byte [esi + edx], bl
mov edx, dword [0x10609888]
add edx, 0x1cfe
mov dword [0x10609884], edx
mov edx, dword [0x1060988c]
mov esi, dword [ebp - 0x1c]
movzx edx, byte [esi + edx]
mov esi, dword [0x10609890]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
add edx, esi
mov dword [ebp - 0x20], edx
mov edx, dword [0x10609888]
add edx, 0x970
mov dword [0x10609884], edx
mov dword [0x10609884], 0x359
mov edx, dword [ebp - 0x20]
mov eax, edx
cdq
idiv ecx
mov dword [0x1060989c], edx
mov edx, dword [0x10609888]
sub edx, 0x28d
mov dword [0x10609884], edx
mov dword [0x10609888], 0xe9b
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
mov esi, dword [0x1060989c]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
xor edx, esi
mov bl, dl
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], bl
mov dword [0x10609884], 0xeba
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
jmp 0x10590a22
mov dword [0x10609888], 0x2467
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x485524
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49cdb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0047c542
and dword [ebp - 0x14], 0
cmp dword [0x49f260], 0
mov dword [ebp - 0x18], eax
jne 0x4855d7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x48567f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x48567f
mov esi, dword [fcn.004759f0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x49f260], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x49f264], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x49f268], eax
call edi
push eax
call esi
mov dword [0x49f270], eax
test eax, eax
je 0x4855d7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x49f26c], eax
mov eax, dword [0x49f26c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.004759f4]
cmp eax, ecx
je 0x485630
cmp dword [0x49f270], ecx
je 0x485630
push eax
call esi
push dword [0x49f270]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x485630
test ebx, ebx
je 0x485630
call edi
test eax, eax
je 0x485627
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x485627
test byte [ebp - 8], 1
jne 0x485630
or dword [ebp + 0x10], 0x200000
jmp 0x485663
mov eax, dword [0x49f264]
cmp eax, dword [ebp - 0x18]
je 0x485663
push eax
call esi
test eax, eax
je 0x485663
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x485663
mov eax, dword [0x49f268]
cmp eax, dword [ebp - 0x18]
je 0x485663
push eax
call esi
test eax, eax
je 0x485663
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x49f260]
call esi
test eax, eax
je 0x48567f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x485681
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f404
leave
ret

Function at 0x4022e9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, 0x12897
add eax, 0x3ec
mov ecx, edx
push ecx
sub esp, 4
mov dword [esp], 0x40
push 0x3000
push eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
pop ecx
mov ecx, esi
mov esi, dword [esp]
add esi, 0x99
mov edi, eax
mov ecx, 0x1e3
push eax
mov edx, 0xfc47a685
add dl, bl
xor ebp, ebp
push edx
mov bh, byte [esi]
add bh, byte [esp]
add byte [edi], bh
pop edx
add esi, 1
inc edi
mov eax, 0
sub eax, 0xdf16
add eax, 0xdf1a
add ebp, 1
shr edx, 8
cmp eax, ebp
jne 0x402365
mov ebp, 0xfc47a685
mov edx, ebp
mov ebp, 0
add dl, bl
sub ecx, 0x6e438
add ecx, 0x6e437
test ecx, ecx
jne 0x402333
pop eax
call eax
cmp eax, eax
jne 0x402365
ret 0x8c
Function at 0x422be0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x422d3e
nop
jl 0x422c37
int1
ror dword [edi], 1
push cs
cmpsb byte [esi], byte es:[edi]
jb 0x422c2b
push cs
sbb ah, cl
popal
loope 0x422c54
popal
popal
popal
popal
popal
jnp 0x422bf1
mov bh, 0x79
div byte [esi - 0x97bd510]
jp 0x422bf3
jb 0x422c25
or eax, 0x1c832ae0
dec ecx
invalid
jb 0x422c46
or eax, 0x15822ae0
sar byte [eax], 0x72
adc eax, 0x197238c0
cmp esp, 0x30
sbb edx, esi
cmp esp, 0x30
adc ecx, edi
stc
jnp 0x422c2f
div dword [edi - 0x7af1fe8e]
test dword [eax + 0x34], edi
lock sub al, byte [esi + esi*8 + 0x1f72ef7a]
mov bh, 0x72
add dword [esi], ecx
test dword [ebp + 0x2af03478], eax
test dh, dh
jp 0x422c35
jb 0x422c67
or eax, 0x38e02ae0
lock sub al, byte [esi + esi*8 + 0x1f72ef7a]
pop ds
or eax, 0x38e02ae0
test cl, dl
mov al, 0xf0
sub al, byte [esi + esi*8 + 0x1f72ef7a]
or eax, 0x38e02ae0
lock sub al, byte [edx + 0x7af8841e]
sub ah, al
cmp al, dh
sub al, byte [edx + 0x7af8841e]
out dx, eax
jb 0x422c93
or eax, 0x15822ae0
jb 0x422cab
xor bl, dh
jo 0x422c8a
jo 0x422c8a
int1
add cl, byte [esi]
push cs
jb 0x422ca4
invalid
or eax, 0xf37bfe87
mov bl, 0x79
div byte [esi + 0x180684b8]
xchg edx, eax
mov eax, 0x92180684
push cs
push cs
push cs
popal
jp 0x422c91
jb 0x422cd3
cmc
js 0x422c99
jb 0x422cdb
cmc
cmc
jb 0x422cc0
cmc
xchg byte [eax], al
lock sbb byte ds:[ebp - 0x50f1f1f2], bh
scasd eax, dword es:[edi]
js 0x422cbb
dec eax
int1
int1
int1
jnp 0x422cb2
div byte [esi - 0xf32e623]
xchg byte [esi], al
mov dh, 0xdd
sbb ebp, ecx
lock xchg byte [esi], al
jno 0x422c93
test byte [ebx], al
jp 0x422cc0
jnp 0x422c7a
cmc
xchg edi, eax
xor byte [ecx], bl
stc
xor byte [ecx], dh
loope 0x422d4c
xor eax, 0x1a7109d8
sbb eax, esi
add dword [eax - 0xa], edi
lock add dword [eax - 0xa], edi
jb 0x422d17
hlt
mov dh, 0xa1
mov dh, 0x48
cmpsb byte [esi], byte es:[edi]
mov ecx, 0xea45f03
sbb dword [bp - 0xe0e], esp
clc
xor dword [ebp + 0x72f278f6], eax
xor dh, ch
sbb ch, byte [ecx]
push cs
sbb eax, 0x90f1f2a6
sbb byte [ebx], dl
in eax, dx
std
inc dword [eax]
mov eax, section._4321280
xor byte [eax], 0x56
inc eax
cmp eax, 0x422bcc
jle 0x422d43
mov eax, 0x422be6
xor byte [eax], 0xf1
inc eax
cmp eax, 0x422d38
jle 0x422d53
pushal
mov esi, section._4321280
jmp 0x422be5

Function at 0x52d5c1
Capabilities:
Encode data using xor

Disassembly:
push 1
pop ecx
cmp dword [esp + 8], ecx
jl 0x52d5e1
mov eax, dword [esp + 4]
mov edx, ecx
and edx, 3
mov dl, byte [esp + edx + 0xc]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, dword [esp + 8]
jle 0x52d5ce
ret
Function at 0x402a40
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402a7f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402a7f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402a7f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402a7f
cmp dword [ecx + 0x74], 0xe
jbe 0x402a7f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4083b6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x408453
push ebx
push esi
call fcn.0040837f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004082c8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x408400
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408452
push edi
push eax
call fcn.00406d4b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x408420
call fcn.00406ed7
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408451
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004082c8
add esp, 0x20
test eax, eax
jne 0x40843f
push edi
call fcn.00406ed7
jmp 0x408447
push ebx
call fcn.00406ed7
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4086be
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4109d8
push 0x4109d0
push str.FlsAlloc
push 0x1e
call fcn.004085dc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4086f2
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f144]
call esi
jmp 0x4086f8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40873c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4109e8
push 0x4109e0
push str.FlsGetValue
push 0x20
call fcn.004085dc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408773
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40e110
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e13d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e13d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x2aa01470
Capabilities:
Copy file
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x46c
mov eax, dword [0x2aa01110]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
mov dword [esp + 0x470], eax
push edi
lea eax, [esp + 0x26c]
push eax
push 0x104
call ebx
lea edi, [esp + 0x26c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x2aa014a2
mov ecx, dword [0x2aa01154]
mov edx, dword [0x2aa01158]
mov ax, word [0x2aa0115c]
mov dword [edi], ecx
mov cl, byte [0x2aa0115e]
mov dword [edi + 4], edx
push 0x104
lea edx, [esp + 0x16c]
push edx
mov word [edi + 8], ax
push 0
mov byte [edi + 0xa], cl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
lea eax, [esp + 0x168]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x2aa01510
push 0
push 0
push 0
sub eax, edx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
lea edx, [esp + 0x174]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x64]
push eax
push 0x104
call ebx
lea edi, [esp + 0x64]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x2aa01557
mov ecx, dword [0x2aa01148]
mov edx, dword [0x2aa0114c]
mov ax, word [0x2aa01150]
mov dword [edi], ecx
push 1
mov dword [edi + 4], edx
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x170]
push edx
mov word [edi + 8], ax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor eax, eax
mov cl, byte [esp + eax + 0x64]
mov byte [esp + eax + 0x370], cl
inc eax
test cl, cl
jne 0x2aa01591
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x390]
push edx
lea eax, [esp + 0x88]
push eax
mov dword [esp + 0x48], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x474]
pop edi
pop esi
pop ebx
nop
nop
nop
nop
nop
add esp, 0x46c
ret