joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000af90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x1002db38]
jg 0x1000afcb
push 0x1002db3c
call fcn.1000c340
mov ecx, dword [0x1002db34]
add esp, 4
test ecx, ecx
je 0x1000afbd
mov eax, dword [ecx]
mov dword [0x1002db34], eax
mov dword [0x1002db3c], 1
test ecx, ecx
jne 0x1000afe1
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1000afe8
mov eax, ecx
pop esi
pop ebp
ret 4
push 0xffffffffffffffff
call fcn.10010fb9
int3

Function at 0x1000b050
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x1002db2c]
jb 0x1000b0c4
cmp esi, dword [0x1002db30]
jae 0x1000b0c4
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x1002db38]
jle 0x1000b0d9
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1000b0dd
push dword [0x1002db38]
push esi
push edi
call fcn.10010710
push 0x1002db3c
call fcn.1000c340
mov eax, dword [0x1002db34]
add esp, 0x10
mov dword [esi], eax
mov dword [0x1002db34], esi
mov esi, edi
mov dword [0x1002db3c], 1
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
push dword [ebp + 0xc]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
test esi, esi
jne 0x1000b0bd
push 0xffffffffffffffff
call fcn.10010fb9
int3
Function at 0x52622a
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x526248
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x52623d
pop esi
ret

Function at 0x5caa20
Capabilities:
Check for trap flag exception

Disassembly:
push 0xbbbc5c08
call fcn.005d5be9
jp 0x5caa4f
in eax, dx
jge 0x5caa09
div dword [edx + 0x7c]
dec edi
salc
inc ecx
ret
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
jmp 0x5caa31
jmp 0x5ca9f6
add eax, 0xc341d600
jp 0x5caab8
cmp al, 0xd1
xchg ecx, eax
pop ebx
invalid
cwde
sti
pushfd
or dword [esp], reloc.MSVCRT.dll_strncpy
popfd
cpuid
nop
jmp 0x5caad1
pop ebx
ret

Function at 0x5d5b16
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 4], edi
call fcn.005d5ac6

Function at 0x5d5b1f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ebp
call fcn.005d5b9f
add ebx, 0xbc7a34
jmp 0x5d79d3
jmp 0x5d9915
add edx, 0x7cb882da
jmp 0x5d9398
not edx
lea eax, [edx + esi]
rcr ah, 1
rdtsc
rdtsc
ror ax, cl
mov ax, 0x5ca8
jmp 0x5d9503
call fcn.005d87c5
jno 0x5d937d
jo 0x5d7a92
dec edi
retf
jmp 0x5d7a92
mov eax, ebp
mov ah, 0xbd
jmp 0x5d9454
bsf ax, bx
jp 0x5d9382
mov eax, ebp
call fcn.005d9442
sbb al, 0xb4
mov ebp, 0xa7e9
add cl, ch
mov dh, 0
add byte [eax], al
jns 0x5d8951
jmp 0x5d9468
not edx
lea eax, [edx + esi]
jmp 0x5d976f
mov esp, esi
mov al, byte [esp]
push ebp
dec al
jp 0x5d93ad
jnp 0x5d9468
xor ebp, dword [edx]
inc ebp
hlt
push edx
ret
mov eax, dword [esp]
neg dx
jmp 0x5d94d9
mov eax, dword [esp]
neg dx
add cl, 0xf0
lea edx, [esp + edi]
jmp 0x5d94e5
lea eax, [ecx + esi]
call fcn.005d9522
xchg dh, ah
mov eax, esp
mov dl, byte [esp]
not ah
jmp 0x5d950c
neg cl
not dh
stc
jo 0x5d94d3
jno 0x5d94bd
lea esp, [esp + 4]
neg cl
mov eax, edx
xchg dx, ax
jmp 0x5d9560
mov eax, 0x468ac2c3
mov ah, byte [esp]
rol cl, 0
call fcn.005d954a
call fcn.005d959f
lea esp, [esp + 3]
and ecx, 0x3c
call fcn.005d95fb
cld
invalid
rcr ah, 1
rdtsc
rdtsc
call fcn.005d94bb
ror edx, cl
jae 0x5d9362
jb 0x5d9362
neg edx
or edx, edi
call fcn.005d9996
jo 0x5d99ab
add edx, dword [ebx + reloc.MSVCRT.dll_strncpy]
int1
ljmp 0xf766
bsf edx, edi
neg dx
jmp 0x5d9923
add al, 0xb4
call fcn.005d9b62
pushfd
out dx, eax
xor byte [ebx + 0x1cad5e3b], ch
push esi
int3
bsr dx, sp
jb 0x5d9939
bsf edx, edi
neg dx
neg edx
or edx, edi
jmp 0x5d9941
rol dword [eax + reloc.MSVCRT.dll_strncpy], 0x8a
xor al, 0x24
mov dx, word [esp]
mov dx, si
not al
mov dx, 0xb636
jmp 0x5d996a
Function at 0x5da1d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, cl
xchg dword [esp + 4], ebx
jmp 0x5da215
neg ax
sete al
bsr ax, dx
Function at 0x5dd495
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf05c6efc
jmp 0x5dd4b6
lea esp, [esp + 2]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
pushfd
jmp 0x5dbad7
push di
lea esp, [esp + 4]
lea esp, [esp]
jmp 0x5dd46e
stc
jae 0x5dd4bc
mov dh, byte [esp]
mov eax, esi
call fcn.005dd50b
xor al, 0xa7
aaa
push edx
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov dx, 0xa8a5
jmp 0x5dd4a0
mov dh, byte [esp]
mov eax, esi
jmp 0x5dd525
mov ebp, dword [esp + 0x2c]
cpuid
xchg edi, eax
jmp 0x5dd5d9
stc
push ebp
jmp 0x5dd5b6
rcl cx, cl
jb 0x5dd569
stc
push ebp
jmp 0x5dd5b6
mov al, byte [esp]
lea esi, [esp]
jmp 0x5dd57f
bt edx, ebx
jg 0x5dd5e1
jle 0x5dd5e1
mov ebp, 0xc7342d
or byte [esi + 0x27967b1c], cl
lahf
out 0x11, al
sub esp, 0xbc
mov edi, esp
mov ax, cx
cpuid
jmp 0x5dd5a0
cmc
jae 0x5dd598
mov al, byte [esp]
jmp 0x5dd59b

Function at 0x5dd50b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, 0x7b27
lea edx, [edx - 0xe6]
setae ch
lea ebx, [ebx + 0x78]
jmp 0x5dd60a
mov eax, ebp
adc dx, ax
clc
xchg dword [esp], ebx
neg si
jmp 0x5dd4f5
and di, dx
mov cx, word [esp]
call fcn.005dd55d
Function at 0x40358e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push edi
lea eax, [ebp - 0x104]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4035c7
push 1
push str.Unable_to_resolve_path_to_current_executable
call fcn.00403384
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov edi, dword [ebp + 8]
or ebx, 0xffffffff
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x104]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0x40369c
mov edi, dword [ebp + 8]
mov ecx, ebx
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x104]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
mov ecx, ebx
repne scasb al, byte es:[edi]
dec edi
mov esi, str._bin_
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, edx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov eax, 0x40999c
dec edi
mov esi, eax
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
cmp byte [0x40aed2], 0
je 0x403681
mov esi, dword [sym.imp.MSVCRT.dll_printf]
lea eax, [ebp - 0x104]
push eax
push str.execv___s_
call esi
mov eax, dword [edi]
pop ecx
test eax, eax
pop ecx
je 0x403679
mov ebx, edi
push eax
push str.____s_
call esi
mov eax, dword [ebx + 4]
add ebx, 4
pop ecx
test eax, eax
pop ecx
jne 0x403665
push 0x4099c0
call esi
pop ecx
lea eax, [ebp - 0x104]
push edi
push eax
push 0
call dword [sym.imp.MSVCRT.dll__spawnv]
add esp, 0xc
push eax
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
pop edi
pop ebx
leave
ret
Function at 0x4063ea
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407378
push 0x406520
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x40af18], 0xffffffff
or dword [0x40af1c], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x40af14]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x40af10]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40af20], eax
call fcn.004062b7
cmp dword [0x40aeb0], 0
jne 0x40646d
push 0x406518
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00406506
push 0x40800c
push 0x408008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x40af0c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40af08]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x408004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call section..text
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x4011a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x974
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x310]
push edi
push 0x208
push 0
push eax
call fcn.00402470
add esp, 0xc
lea eax, [ebp - 0x310]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor ecx, ecx
movzx eax, word [ebp + ecx - 0x310]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x51a], ax
test ax, ax
jne 0x4011f1
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x518]
push eax
call esi
push 0x250
lea eax, [ebp - 0x970]
push 0
push eax
call fcn.00402470
add esp, 0xc
lea eax, [ebp - 0x970]
push eax
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x974], edi
cmp edi, 0xffffffff
je 0x4013a2
test byte [ebp - 0x970], 0x10
jne 0x401273
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.004010b0
add esp, 8
cmp dword [0x41e944], 0
jne 0x40139b
lea eax, [ebp - 0x970]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40139b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [eax]
test byte [ebp - 0x970], 0x10
jne 0x401384
xor eax, eax
nop
movzx ecx, word [ebp + eax - 0x310]
lea eax, [eax + 2]
mov word [ebp + eax - 0x722], cx
test cx, cx
jne 0x4012b0
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0x720]
push eax
call esi
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x401375
push str.DllPrefix
push esi
call ebx
mov edi, eax
test edi, edi
je 0x40136f
call edi
push eax
lea eax, [ebp - 0x108]
push str._s_EnumV2
push eax
call fcn.004017b0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push esi
call ebx
mov dword [0x41e944], eax
call edi
push eax
lea eax, [ebp - 0x108]
push str._s_Update
push eax
call fcn.004017b0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push esi
call ebx
mov dword [0x41e948], eax
call edi
push eax
lea eax, [ebp - 0x108]
push str._s_GigeEnable
push eax
call fcn.004017b0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push esi
call ebx
mov dword [0x41e940], eax
mov edi, dword [ebp - 0x974]
cmp dword [0x41e944], 0
jne 0x40139a
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x970]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4012a0
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004017e1
mov esp, ebp
pop ebp
ret

Function at 0x40200c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40204b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40204b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40204b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40204b
cmp dword [ecx + 0x74], 0xe
jbe 0x40204b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x409476
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417a58
push 0x417a50
push str.FlsAlloc
push 0x1f
call fcn.00409335
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4094aa
push dword [ebp + 8]
mov ecx, esi
call dword [0x416134]
call esi
jmp 0x4094b0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4094f4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417a68
push 0x417a60
push str.FlsGetValue
push 0x21
call fcn.00409335
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40952b
push dword [ebp + 8]
mov ecx, esi
call dword [0x416134]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x409533
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417a70
push 0x417a68
push str.FlsSetValue
push 0x22
call fcn.00409335
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40956d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416134]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40d6c1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40d75e
push ebx
push esi
call fcn.0040d68a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040d61e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40d70b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40d75d
push edi
push eax
call fcn.0040ac9a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40d72b
call fcn.004091c8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40d75c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040d61e
add esp, 0x20
test eax, eax
jne 0x40d74a
push edi
call fcn.004091c8
jmp 0x40d752
push ebx
call fcn.004091c8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40f386
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x41efc0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40f3c6
cmp byte [ebx], 0xa
jne 0x40f3c6
or byte [edi + eax + 0x28], 4
jmp 0x40f3cb
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x40f4ca
mov dl, byte [eax]
cmp dl, 0x1a
je 0x40f4ad
inc eax
cmp dl, 0xd
je 0x40f3f7
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x40f41d
cmp eax, ecx
jae 0x40f42b
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x40f3df
jmp 0x40f4ca
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40f4a8
cmp dword [ebp - 0x10], 0
je 0x40f4a8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x41efc0]
test byte [eax + edi + 0x28], 0x48
je 0x40f482
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x40f46d
mov byte [esi], dl
jmp 0x40f47e
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x41efc0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x40f4ca
cmp byte [ebp - 1], 0xa
jne 0x40f491
cmp esi, ebx
jne 0x40f491
mov byte [esi], 0xa
jmp 0x40f4c9
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040f2f6
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x40f4ca
mov byte [esi], 0xd
jmp 0x40f4c9
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x41efc0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x40f4c7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x40f4ca
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40f4d3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x41efc0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40f519
cmp word [ebx], dx
jne 0x40f519
or byte [eax + edi + 0x28], 4
jmp 0x40f51e
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x40f681
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x40f661
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x40f55f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x40f595
cmp eax, edx
jae 0x40f5a3
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x40f53a
jmp 0x40f681
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40f65c
cmp dword [ebp - 0x18], 0
je 0x40f65c
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x41efc0]
test byte [eax + edi + 0x28], 0x48
je 0x40f632
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x40f5f6
mov word [esi], cx
jmp 0x40f62d
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x41efc0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x41efc0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x41efc0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x40f681
pop eax
cmp word [ebp - 4], ax
jne 0x40f642
cmp esi, ebx
jne 0x40f642
mov word [esi], ax
jmp 0x40f67e
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0040f2f6
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x40f681
push 0xd
pop eax
jmp 0x40f63d
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x41efc0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x40f67b
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x40f681
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x415570
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41559d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41559d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x438860
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22000]
push edi
or ebp, 0xffffffff
jmp 0x438882
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x438889
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x438878
mov eax, 1
add ebx, ebx
jne 0x43889b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x438890
jne 0x4388ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x438890
xor ecx, ecx
sub eax, 3
jb 0x4388c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x438932
mov ebp, eax
add ebx, ebx
jne 0x4388cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4388d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4388fc
inc ecx
add ebx, ebx
jne 0x4388e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4388dd
jne 0x4388f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4388dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43891c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43890d
jmp 0x43887e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43891c
add edi, ecx
jmp 0x43887e
pop esi
mov edi, esi
mov ecx, 0xe0e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43893a
cmp byte [edi], 0xa
jne 0x43893a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x43893f
lea edi, [esi + 0x36000]
mov eax, dword [edi]
or eax, eax
je 0x4389b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3820c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x382ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43896c
mov ecx, edi
jns 0x43899b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x382b0]
or eax, eax
je 0x4389b1
mov dword [ebx], eax
add ebx, 4
jmp 0x438989
call dword [esi + 0x382b4]
popal
jmp 0x41be59
Function at 0x402710
Capabilities:
Enumerate threads
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0x1c
mov eax, dword [ebp + 8]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x402790
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jne 0x40277e
mov ecx, dword [ebp - 0x18]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x40277e
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x402748
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406546
mov esp, ebp
pop ebp
ret

Function at 0x402900
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x42e040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x660]
push eax
call fcn.00407fc0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x670], ecx
mov dword [ebp - 0x66c], ecx
mov dword [ebp - 0x668], ecx
mov dword [ebp - 0x664], ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
push str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
push 0x208
lea ecx, [ebp - 0x61c]
push ecx
call fcn.004027b0
add esp, 0x10
lea edx, [ebp - 0x670]
push edx
lea eax, [ebp - 0x660]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [ebp - 0x61c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, dword [ebp - 0x66c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406546
mov esp, ebp
pop ebp
ret